<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8"/>
<link href="common/css/sf.css" rel="stylesheet" type="text/css"/>
<title>Hoare2: Hoare Logic, Part II</title>
</head>
<link href="common/jquery-ui/jquery-ui.css" rel="stylesheet">
<script src="common/jquery-ui/external/jquery/jquery.js"></script>
<script src="common/jquery-ui/jquery-ui.js"></script>
<script src="common/toggleproofs.js"></script>
<link href="common/css/plf.css" rel="stylesheet" type="text/css"/>

<body>

<div id="page">

<div id="header">
<a href='https://www.cis.upenn.edu/~bcpierce/sf/current/index.html'>
<img src='common/media/image/sf_logo_sm.png'></a>
</br><a href='index.html'>  <span class='booktitleinheader'>Volume 2: Programming Language Foundations</span><br></br>
<ul id='menu'>
   <a href='toc.html'><li class='section_name'>Table of Contents</li></a>
   <a href='coqindex.html'><li class='section_name'>Index</li></a>
   <a href='deps.html'><li class='section_name'>Roadmap</li></a>
</ul>
</a></div>

<div id="main">

<h1 class="libtitle">Hoare2<span class="subtitle">Hoare Logic, Part II</span></h1>


<div class="code code-tight">

<span class="id" type="keyword">Set</span> <span class="id" type="var">Warnings</span> "-notation-overridden,-parsing".<br/>
<span class="id" type="var">From</span> <span class="id" type="var">Coq</span> <span class="id" type="keyword">Require</span> <span class="id" type="keyword">Import</span> <span class="id" type="var">Strings.String</span>.<br/>
<span class="id" type="var">From</span> <span class="id" type="var">PLF</span> <span class="id" type="keyword">Require</span> <span class="id" type="keyword">Import</span> <span class="id" type="var">Maps</span>.<br/>
<span class="id" type="var">From</span> <span class="id" type="var">Coq</span> <span class="id" type="keyword">Require</span> <span class="id" type="keyword">Import</span> <span class="id" type="var">Bool.Bool</span>.<br/>
<span class="id" type="var">From</span> <span class="id" type="var">Coq</span> <span class="id" type="keyword">Require</span> <span class="id" type="keyword">Import</span> <span class="id" type="var">Arith.Arith</span>.<br/>
<span class="id" type="var">From</span> <span class="id" type="var">Coq</span> <span class="id" type="keyword">Require</span> <span class="id" type="keyword">Import</span> <span class="id" type="var">Arith.EqNat</span>.<br/>
<span class="id" type="var">From</span> <span class="id" type="var">Coq</span> <span class="id" type="keyword">Require</span> <span class="id" type="keyword">Import</span> <span class="id" type="var">Arith.PeanoNat</span>. <span class="id" type="keyword">Import</span> <span class="id" type="var">Nat</span>.<br/>
<span class="id" type="var">From</span> <span class="id" type="var">Coq</span> <span class="id" type="keyword">Require</span> <span class="id" type="keyword">Import</span> <span class="id" type="var">omega.Omega</span>.<br/>
<span class="id" type="var">From</span> <span class="id" type="var">PLF</span> <span class="id" type="keyword">Require</span> <span class="id" type="keyword">Import</span> <span class="id" type="var">Hoare</span>.<br/>
<span class="id" type="var">From</span> <span class="id" type="var">PLF</span> <span class="id" type="keyword">Require</span> <span class="id" type="keyword">Import</span> <span class="id" type="var">Imp</span>.<br/>
</div>

<div class="doc">
<a name="lab80"></a><h1 class="section">Decorated Programs</h1>

<div class="paragraph"> </div>

 The beauty of Hoare Logic is that it is <i>compositional</i>: the
    structure of proofs exactly follows the structure of programs.

<div class="paragraph"> </div>

    This suggests that we can record the essential ideas of a
    proof (informally, and leaving out some low-level calculational
    details) by "decorating" a program with appropriate assertions on
    each of its commands.

<div class="paragraph"> </div>

    Such a <i>decorated program</i> carries within it an argument for its
    own correctness. 
<div class="paragraph"> </div>

 For example, consider the program: 

<div class="paragraph"> </div>

<div class="code code-tight">
&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="var">X</span>&nbsp;<span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>:</span>:</span>=</span>&nbsp;<span class="id" type="var">m</span>;;<br/>
&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="var">Z</span>&nbsp;<span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>:</span>:</span>=</span>&nbsp;<span class="id" type="var">p</span>;<br/>
&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="var">WHILE</span>&nbsp;~(<span class="id" type="var">X</span>&nbsp;=&nbsp;0)&nbsp;<span class="id" type="var">DO</span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="var">Z</span>&nbsp;<span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>:</span>:</span>=</span>&nbsp;<span class="id" type="var">Z</span>&nbsp;-&nbsp;1;;<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="var">X</span>&nbsp;<span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>:</span>:</span>=</span>&nbsp;<span class="id" type="var">X</span>&nbsp;-&nbsp;1<br/>
&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="var">END</span>
<div class="paragraph"> </div>

</div>
   (Note the <i>parameters</i> <span class="inlinecode"><span class="id" type="var">m</span></span> and <span class="inlinecode"><span class="id" type="var">p</span></span>, which stand for
   fixed-but-arbitrary numbers.  Formally, they are simply Coq
   variables of type <span class="inlinecode"><span class="id" type="var">nat</span></span>.)
 Here is one possible specification for this program:

<div class="paragraph"> </div>

<div class="code code-tight">
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{&nbsp;<span class="id" type="var">True</span>&nbsp;<span style='letter-spacing:-.4em;'>}</span>}<br/>
&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="var">X</span>&nbsp;<span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>:</span>:</span>=</span>&nbsp;<span class="id" type="var">m</span>;;<br/>
&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="var">Z</span>&nbsp;<span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>:</span>:</span>=</span>&nbsp;<span class="id" type="var">p</span>;<br/>
&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="var">WHILE</span>&nbsp;~(<span class="id" type="var">X</span>&nbsp;=&nbsp;0)&nbsp;<span class="id" type="var">DO</span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="var">Z</span>&nbsp;<span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>:</span>:</span>=</span>&nbsp;<span class="id" type="var">Z</span>&nbsp;-&nbsp;1;;<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="var">X</span>&nbsp;<span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>:</span>:</span>=</span>&nbsp;<span class="id" type="var">X</span>&nbsp;-&nbsp;1<br/>
&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="var">END</span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{&nbsp;<span class="id" type="var">Z</span>&nbsp;=&nbsp;<span class="id" type="var">p</span>&nbsp;-&nbsp;<span class="id" type="var">m</span>&nbsp;<span style='letter-spacing:-.4em;'>}</span>}
<div class="paragraph"> </div>

</div>
 Here is a decorated version of the program, embodying a
    proof of this specification: 

<div class="paragraph"> </div>

<div class="code code-tight">
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{&nbsp;<span class="id" type="var">True</span>&nbsp;<span style='letter-spacing:-.4em;'>}</span>}&nbsp;<span class="nowrap"><span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>-</span></span><span style='letter-spacing:-.2em;'>></span>></span></span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{&nbsp;<span class="id" type="var">m</span>&nbsp;=&nbsp;<span class="id" type="var">m</span>&nbsp;<span style='letter-spacing:-.4em;'>}</span>}<br/>
&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="var">X</span>&nbsp;<span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>:</span>:</span>=</span>&nbsp;<span class="id" type="var">m</span>;;<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{&nbsp;<span class="id" type="var">X</span>&nbsp;=&nbsp;<span class="id" type="var">m</span>&nbsp;<span style='letter-spacing:-.4em;'>}</span>}&nbsp;<span class="nowrap"><span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>-</span></span><span style='letter-spacing:-.2em;'>></span>></span></span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{&nbsp;<span class="id" type="var">X</span>&nbsp;=&nbsp;<span class="id" type="var">m</span>&nbsp;∧&nbsp;<span class="id" type="var">p</span>&nbsp;=&nbsp;<span class="id" type="var">p</span>&nbsp;<span style='letter-spacing:-.4em;'>}</span>}<br/>
&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="var">Z</span>&nbsp;<span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>:</span>:</span>=</span>&nbsp;<span class="id" type="var">p</span>;<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{&nbsp;<span class="id" type="var">X</span>&nbsp;=&nbsp;<span class="id" type="var">m</span>&nbsp;∧&nbsp;<span class="id" type="var">Z</span>&nbsp;=&nbsp;<span class="id" type="var">p</span>&nbsp;<span style='letter-spacing:-.4em;'>}</span>}&nbsp;<span class="nowrap"><span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>-</span></span><span style='letter-spacing:-.2em;'>></span>></span></span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{&nbsp;<span class="id" type="var">Z</span>&nbsp;-&nbsp;<span class="id" type="var">X</span>&nbsp;=&nbsp;<span class="id" type="var">p</span>&nbsp;-&nbsp;<span class="id" type="var">m</span>&nbsp;<span style='letter-spacing:-.4em;'>}</span>}<br/>
&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="var">WHILE</span>&nbsp;~(<span class="id" type="var">X</span>&nbsp;=&nbsp;0)&nbsp;<span class="id" type="var">DO</span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{&nbsp;<span class="id" type="var">Z</span>&nbsp;-&nbsp;<span class="id" type="var">X</span>&nbsp;=&nbsp;<span class="id" type="var">p</span>&nbsp;-&nbsp;<span class="id" type="var">m</span>&nbsp;∧&nbsp;<span class="id" type="var">X</span>&nbsp;≠&nbsp;0&nbsp;<span style='letter-spacing:-.4em;'>}</span>}&nbsp;<span class="nowrap"><span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>-</span></span><span style='letter-spacing:-.2em;'>></span>></span></span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{&nbsp;(<span class="id" type="var">Z</span>&nbsp;-&nbsp;1)&nbsp;-&nbsp;(<span class="id" type="var">X</span>&nbsp;-&nbsp;1)&nbsp;=&nbsp;<span class="id" type="var">p</span>&nbsp;-&nbsp;<span class="id" type="var">m</span>&nbsp;<span style='letter-spacing:-.4em;'>}</span>}<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="var">Z</span>&nbsp;<span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>:</span>:</span>=</span>&nbsp;<span class="id" type="var">Z</span>&nbsp;-&nbsp;1;;<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{&nbsp;<span class="id" type="var">Z</span>&nbsp;-&nbsp;(<span class="id" type="var">X</span>&nbsp;-&nbsp;1)&nbsp;=&nbsp;<span class="id" type="var">p</span>&nbsp;-&nbsp;<span class="id" type="var">m</span>&nbsp;<span style='letter-spacing:-.4em;'>}</span>}<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="var">X</span>&nbsp;<span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>:</span>:</span>=</span>&nbsp;<span class="id" type="var">X</span>&nbsp;-&nbsp;1<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{&nbsp;<span class="id" type="var">Z</span>&nbsp;-&nbsp;<span class="id" type="var">X</span>&nbsp;=&nbsp;<span class="id" type="var">p</span>&nbsp;-&nbsp;<span class="id" type="var">m</span>&nbsp;<span style='letter-spacing:-.4em;'>}</span>}<br/>
&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="var">END</span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{&nbsp;<span class="id" type="var">Z</span>&nbsp;-&nbsp;<span class="id" type="var">X</span>&nbsp;=&nbsp;<span class="id" type="var">p</span>&nbsp;-&nbsp;<span class="id" type="var">m</span>&nbsp;∧&nbsp;¬(<span class="id" type="var">X</span>&nbsp;≠&nbsp;0)&nbsp;<span style='letter-spacing:-.4em;'>}</span>}&nbsp;<span class="nowrap"><span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>-</span></span><span style='letter-spacing:-.2em;'>></span>></span></span>&nbsp;<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{&nbsp;<span class="id" type="var">Z</span>&nbsp;=&nbsp;<span class="id" type="var">p</span>&nbsp;-&nbsp;<span class="id" type="var">m</span>&nbsp;<span style='letter-spacing:-.4em;'>}</span>}
<div class="paragraph"> </div>

</div>

<div class="paragraph"> </div>

 Concretely, a decorated program consists of the program text
    interleaved with assertions (either a single assertion or possibly
    two assertions separated by an implication). 
<div class="paragraph"> </div>

 To check that a decorated program represents a valid proof, we
    check that each individual command is <i>locally consistent</i> with
    its nearby assertions in the following sense: 
<div class="paragraph"> </div>


<div class="paragraph"> </div>

<ul class="doclist">
<li> <span class="inlinecode"><span class="id" type="var">SKIP</span></span> is locally consistent if its precondition and
      postcondition are the same:

<div class="paragraph"> </div>

<div class="code code-tight">
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{&nbsp;<span class="id" type="var">P</span>&nbsp;<span style='letter-spacing:-.4em;'>}</span>}&nbsp;<span class="id" type="var">SKIP</span>&nbsp;<span style='letter-spacing:-.4em;'>{</span>{&nbsp;<span class="id" type="var">P</span>&nbsp;<span style='letter-spacing:-.4em;'>}</span>}
<div class="paragraph"> </div>

</div>

</li>
</ul>

<div class="paragraph"> </div>


<div class="paragraph"> </div>

<ul class="doclist">
<li> The sequential composition of <span class="inlinecode"><span class="id" type="var">c<sub>1</sub></span></span> and <span class="inlinecode"><span class="id" type="var">c<sub>2</sub></span></span> is locally
      consistent (with respect to assertions <span class="inlinecode"><span class="id" type="var">P</span></span> and <span class="inlinecode"><span class="id" type="var">R</span></span>) if <span class="inlinecode"><span class="id" type="var">c<sub>1</sub></span></span> is
      locally consistent (with respect to <span class="inlinecode"><span class="id" type="var">P</span></span> and <span class="inlinecode"><span class="id" type="var">Q</span></span>) and <span class="inlinecode"><span class="id" type="var">c<sub>2</sub></span></span> is
      locally consistent (with respect to <span class="inlinecode"><span class="id" type="var">Q</span></span> and <span class="inlinecode"><span class="id" type="var">R</span></span>):

<div class="paragraph"> </div>

<div class="code code-tight">
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{&nbsp;<span class="id" type="var">P</span>&nbsp;<span style='letter-spacing:-.4em;'>}</span>}&nbsp;<span class="id" type="var">c<sub>1</sub></span>;;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{&nbsp;<span class="id" type="var">Q</span>&nbsp;<span style='letter-spacing:-.4em;'>}</span>}&nbsp;<span class="id" type="var">c<sub>2</sub></span>&nbsp;<span style='letter-spacing:-.4em;'>{</span>{&nbsp;<span class="id" type="var">R</span>&nbsp;<span style='letter-spacing:-.4em;'>}</span>}
<div class="paragraph"> </div>

</div>

</li>
</ul>

<div class="paragraph"> </div>


<div class="paragraph"> </div>

<ul class="doclist">
<li> An assignment is locally consistent if its precondition is the
      appropriate substitution of its postcondition:

<div class="paragraph"> </div>

<div class="code code-tight">
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{&nbsp;<span class="id" type="var">P</span>&nbsp;[<span class="id" type="var">X</span>&nbsp;<span class="nowrap"><span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>&#x22A2;</span><span style='font-size:90%;'>&gt;</span></span></span></span>&nbsp;<span class="id" type="var">a</span>]&nbsp;<span style='letter-spacing:-.4em;'>}</span>}<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="var">X</span>&nbsp;<span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>:</span>:</span>=</span>&nbsp;<span class="id" type="var">a</span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{&nbsp;<span class="id" type="var">P</span>&nbsp;<span style='letter-spacing:-.4em;'>}</span>}
<div class="paragraph"> </div>

</div>

</li>
</ul>

<div class="paragraph"> </div>


<div class="paragraph"> </div>

<ul class="doclist">
<li> A conditional is locally consistent (with respect to assertions
      <span class="inlinecode"><span class="id" type="var">P</span></span> and <span class="inlinecode"><span class="id" type="var">Q</span></span>) if the assertions at the top of its "then" and
      "else" branches are exactly <span class="inlinecode"><span class="id" type="var">P</span></span> <span class="inlinecode">∧</span> <span class="inlinecode"><span class="id" type="var">b</span></span> and <span class="inlinecode"><span class="id" type="var">P</span></span> <span class="inlinecode">∧</span> <span class="inlinecode">¬<span class="id" type="var">b</span></span> and if its
      "then" branch is locally consistent (with respect to <span class="inlinecode"><span class="id" type="var">P</span></span> <span class="inlinecode">∧</span> <span class="inlinecode"><span class="id" type="var">b</span></span>
      and <span class="inlinecode"><span class="id" type="var">Q</span></span>) and its "else" branch is locally consistent (with
      respect to <span class="inlinecode"><span class="id" type="var">P</span></span> <span class="inlinecode">∧</span> <span class="inlinecode">¬<span class="id" type="var">b</span></span> and <span class="inlinecode"><span class="id" type="var">Q</span></span>):

<div class="paragraph"> </div>

<div class="code code-tight">
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{&nbsp;<span class="id" type="var">P</span>&nbsp;<span style='letter-spacing:-.4em;'>}</span>}<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="var">TEST</span>&nbsp;<span class="id" type="var">b</span>&nbsp;<span class="id" type="var">THEN</span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{&nbsp;<span class="id" type="var">P</span>&nbsp;∧&nbsp;<span class="id" type="var">b</span>&nbsp;<span style='letter-spacing:-.4em;'>}</span>}<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="var">c<sub>1</sub></span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{&nbsp;<span class="id" type="var">Q</span>&nbsp;<span style='letter-spacing:-.4em;'>}</span>}<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="var">ELSE</span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{&nbsp;<span class="id" type="var">P</span>&nbsp;∧&nbsp;¬<span class="id" type="var">b</span>&nbsp;<span style='letter-spacing:-.4em;'>}</span>}<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="var">c<sub>2</sub></span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{&nbsp;<span class="id" type="var">Q</span>&nbsp;<span style='letter-spacing:-.4em;'>}</span>}<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="var">FI</span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{&nbsp;<span class="id" type="var">Q</span>&nbsp;<span style='letter-spacing:-.4em;'>}</span>}
<div class="paragraph"> </div>

</div>

</li>
</ul>

<div class="paragraph"> </div>


<div class="paragraph"> </div>

<ul class="doclist">
<li> A while loop with precondition <span class="inlinecode"><span class="id" type="var">P</span></span> is locally consistent if its
      postcondition is <span class="inlinecode"><span class="id" type="var">P</span></span> <span class="inlinecode">∧</span> <span class="inlinecode">¬<span class="id" type="var">b</span></span>, if the pre- and postconditions of
      its body are exactly <span class="inlinecode"><span class="id" type="var">P</span></span> <span class="inlinecode">∧</span> <span class="inlinecode"><span class="id" type="var">b</span></span> and <span class="inlinecode"><span class="id" type="var">P</span></span>, and if its body is
      locally consistent:

<div class="paragraph"> </div>

<div class="code code-tight">
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{&nbsp;<span class="id" type="var">P</span>&nbsp;<span style='letter-spacing:-.4em;'>}</span>}<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="var">WHILE</span>&nbsp;<span class="id" type="var">b</span>&nbsp;<span class="id" type="var">DO</span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{&nbsp;<span class="id" type="var">P</span>&nbsp;∧&nbsp;<span class="id" type="var">b</span>&nbsp;<span style='letter-spacing:-.4em;'>}</span>}<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="var">c<sub>1</sub></span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{&nbsp;<span class="id" type="var">P</span>&nbsp;<span style='letter-spacing:-.4em;'>}</span>}<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="var">END</span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{&nbsp;<span class="id" type="var">P</span>&nbsp;∧&nbsp;¬<span class="id" type="var">b</span>&nbsp;<span style='letter-spacing:-.4em;'>}</span>}
<div class="paragraph"> </div>

</div>

</li>
</ul>

<div class="paragraph"> </div>


<div class="paragraph"> </div>

<ul class="doclist">
<li> A pair of assertions separated by <span class="inlinecode"><span class="nowrap"><span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>-</span></span><span style='letter-spacing:-.2em;'>></span>></span></span></span> is locally consistent if
      the first implies the second:

<div class="paragraph"> </div>

<div class="code code-tight">
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{&nbsp;<span class="id" type="var">P</span>&nbsp;<span style='letter-spacing:-.4em;'>}</span>}&nbsp;<span class="nowrap"><span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>-</span></span><span style='letter-spacing:-.2em;'>></span>></span></span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{&nbsp;<span class="id" type="var">P'</span>&nbsp;<span style='letter-spacing:-.4em;'>}</span>}
<div class="paragraph"> </div>

</div>
      This corresponds to the application of <span class="inlinecode"><span class="id" type="var">hoare_consequence</span></span>, and it
      is the <i>only</i> place in a decorated program where checking whether
      decorations are correct is not fully mechanical and syntactic,
      but rather may involve logical and/or arithmetic reasoning. 
</li>
</ul>

<div class="paragraph"> </div>

 These local consistency conditions essentially describe a
    procedure for <i>verifying</i> the correctness of a given proof.
    This verification involves checking that every single command is
    locally consistent with the accompanying assertions.

<div class="paragraph"> </div>

    If we are instead interested in <i>finding</i> a proof for a given
    specification, we need to discover the right assertions.  This can
    be done in an almost mechanical way, with the exception of finding
    loop invariants, which is the subject of the next section.  In the
    remainder of this section we explain in detail how to construct
    decorations for several simple programs that don't involve
    non-trivial loop invariants. 
</div>

<div class="doc">
<a name="lab81"></a><h2 class="section">Example: Swapping Using Addition and Subtraction</h2>

<div class="paragraph"> </div>

 Here is a program that swaps the values of two variables using
    addition and subtraction (instead of by assigning to a temporary
    variable).

<div class="paragraph"> </div>

<div class="code code-tight">
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="var">X</span>&nbsp;<span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>:</span>:</span>=</span>&nbsp;<span class="id" type="var">X</span>&nbsp;+&nbsp;<span class="id" type="var">Y</span>;;<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="var">Y</span>&nbsp;<span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>:</span>:</span>=</span>&nbsp;<span class="id" type="var">X</span>&nbsp;-&nbsp;<span class="id" type="var">Y</span>;;<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="var">X</span>&nbsp;<span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>:</span>:</span>=</span>&nbsp;<span class="id" type="var">X</span>&nbsp;-&nbsp;<span class="id" type="var">Y</span>
<div class="paragraph"> </div>

</div>
    We can prove (informally) using decorations that this program is 
    correct &mdash; i.e., it always swaps the values of variables <span class="inlinecode"><span class="id" type="var">X</span></span> and <span class="inlinecode"><span class="id" type="var">Y</span></span>. 
<div class="paragraph"> </div>


<div class="paragraph"> </div>

<div class="code code-tight">
&nbsp;&nbsp;&nbsp;&nbsp;(1)&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{&nbsp;<span class="id" type="var">X</span>&nbsp;=&nbsp;<span class="id" type="var">m</span>&nbsp;∧&nbsp;<span class="id" type="var">Y</span>&nbsp;=&nbsp;<span class="id" type="var">n</span>&nbsp;<span style='letter-spacing:-.4em;'>}</span>}&nbsp;<span class="nowrap"><span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>-</span></span><span style='letter-spacing:-.2em;'>></span>></span></span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;(2)&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{&nbsp;(<span class="id" type="var">X</span>&nbsp;+&nbsp;<span class="id" type="var">Y</span>)&nbsp;-&nbsp;((<span class="id" type="var">X</span>&nbsp;+&nbsp;<span class="id" type="var">Y</span>)&nbsp;-&nbsp;<span class="id" type="var">Y</span>)&nbsp;=&nbsp;<span class="id" type="var">n</span>&nbsp;∧&nbsp;(<span class="id" type="var">X</span>&nbsp;+&nbsp;<span class="id" type="var">Y</span>)&nbsp;-&nbsp;<span class="id" type="var">Y</span>&nbsp;=&nbsp;<span class="id" type="var">m</span>&nbsp;<span style='letter-spacing:-.4em;'>}</span>}<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="var">X</span>&nbsp;<span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>:</span>:</span>=</span>&nbsp;<span class="id" type="var">X</span>&nbsp;+&nbsp;<span class="id" type="var">Y</span>;;<br/>
&nbsp;&nbsp;&nbsp;&nbsp;(3)&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{&nbsp;<span class="id" type="var">X</span>&nbsp;-&nbsp;(<span class="id" type="var">X</span>&nbsp;-&nbsp;<span class="id" type="var">Y</span>)&nbsp;=&nbsp;<span class="id" type="var">n</span>&nbsp;∧&nbsp;<span class="id" type="var">X</span>&nbsp;-&nbsp;<span class="id" type="var">Y</span>&nbsp;=&nbsp;<span class="id" type="var">m</span>&nbsp;<span style='letter-spacing:-.4em;'>}</span>}<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="var">Y</span>&nbsp;<span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>:</span>:</span>=</span>&nbsp;<span class="id" type="var">X</span>&nbsp;-&nbsp;<span class="id" type="var">Y</span>;;<br/>
&nbsp;&nbsp;&nbsp;&nbsp;(4)&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{&nbsp;<span class="id" type="var">X</span>&nbsp;-&nbsp;<span class="id" type="var">Y</span>&nbsp;=&nbsp;<span class="id" type="var">n</span>&nbsp;∧&nbsp;<span class="id" type="var">Y</span>&nbsp;=&nbsp;<span class="id" type="var">m</span>&nbsp;<span style='letter-spacing:-.4em;'>}</span>}<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="var">X</span>&nbsp;<span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>:</span>:</span>=</span>&nbsp;<span class="id" type="var">X</span>&nbsp;-&nbsp;<span class="id" type="var">Y</span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;(5)&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{&nbsp;<span class="id" type="var">X</span>&nbsp;=&nbsp;<span class="id" type="var">n</span>&nbsp;∧&nbsp;<span class="id" type="var">Y</span>&nbsp;=&nbsp;<span class="id" type="var">m</span>&nbsp;<span style='letter-spacing:-.4em;'>}</span>}
<div class="paragraph"> </div>

</div>
    These decorations can be constructed as follows:

<div class="paragraph"> </div>

<ul class="doclist">
<li> We begin with the undecorated program (the unnumbered lines).

</li>
<li> We add the specification &mdash; i.e., the outer precondition (1)
        and postcondition (5). In the precondition, we use parameters
        <span class="inlinecode"><span class="id" type="var">m</span></span> and <span class="inlinecode"><span class="id" type="var">n</span></span> to remember the initial values of variables <span class="inlinecode"><span class="id" type="var">X</span></span>
        and <span class="inlinecode"><span class="id" type="var">Y</span></span> so that we can refer to them in the postcondition (5).

</li>
<li> We work backwards, mechanically, starting from (5) and
        proceeding until we get to (2). At each step, we obtain the
        precondition of the assignment from its postcondition by
        substituting the assigned variable with the right-hand-side of
        the assignment. For instance, we obtain (4) by substituting
        <span class="inlinecode"><span class="id" type="var">X</span></span> with <span class="inlinecode"><span class="id" type="var">X</span></span> <span class="inlinecode">-</span> <span class="inlinecode"><span class="id" type="var">Y</span></span> in (5), and we obtain (3) by substituting <span class="inlinecode"><span class="id" type="var">Y</span></span>
        with <span class="inlinecode"><span class="id" type="var">X</span></span> <span class="inlinecode">-</span> <span class="inlinecode"><span class="id" type="var">Y</span></span> in (4).

</li>
<li> Finally, we verify that (1) logically implies (2) &mdash; i.e.,
        that the step from (1) to (2) is a valid use of the law of
        consequence. For this we substitute <span class="inlinecode"><span class="id" type="var">X</span></span> by <span class="inlinecode"><span class="id" type="var">m</span></span> and <span class="inlinecode"><span class="id" type="var">Y</span></span> by <span class="inlinecode"><span class="id" type="var">n</span></span>
        and calculate as follows:

<div class="paragraph"> </div>

<div class="code code-tight">
&nbsp;&nbsp;&nbsp;&nbsp;(<span class="id" type="var">m</span>&nbsp;+&nbsp;<span class="id" type="var">n</span>)&nbsp;-&nbsp;((<span class="id" type="var">m</span>&nbsp;+&nbsp;<span class="id" type="var">n</span>)&nbsp;-&nbsp;<span class="id" type="var">n</span>)&nbsp;=&nbsp;<span class="id" type="var">n</span>&nbsp;∧&nbsp;(<span class="id" type="var">m</span>&nbsp;+&nbsp;<span class="id" type="var">n</span>)&nbsp;-&nbsp;<span class="id" type="var">n</span>&nbsp;=&nbsp;<span class="id" type="var">m</span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;(<span class="id" type="var">m</span>&nbsp;+&nbsp;<span class="id" type="var">n</span>)&nbsp;-&nbsp;<span class="id" type="var">m</span>&nbsp;=&nbsp;<span class="id" type="var">n</span>&nbsp;∧&nbsp;<span class="id" type="var">m</span>&nbsp;=&nbsp;<span class="id" type="var">m</span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="var">n</span>&nbsp;=&nbsp;<span class="id" type="var">n</span>&nbsp;∧&nbsp;<span class="id" type="var">m</span>&nbsp;=&nbsp;<span class="id" type="var">m</span>
<div class="paragraph"> </div>

</div>

</li>
</ul>
    Note that, since we are working with natural numbers rather than
    fixed-width machine integers, we don't need to worry about the
    possibility of arithmetic overflow anywhere in this argument.
    This makes life quite a bit simpler! 
</div>

<div class="doc">
<a name="lab82"></a><h2 class="section">Example: Simple Conditionals</h2>

<div class="paragraph"> </div>

 Here is a simple decorated program using conditionals:

<div class="paragraph"> </div>

<div class="code code-tight">
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;(1)&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{<span class="id" type="var">True</span><span style='letter-spacing:-.4em;'>}</span>}<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="var">TEST</span>&nbsp;<span class="id" type="var">X</span>&nbsp;≤&nbsp;<span class="id" type="var">Y</span>&nbsp;<span class="id" type="var">THEN</span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;(2)&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{<span class="id" type="var">True</span>&nbsp;∧&nbsp;<span class="id" type="var">X</span>&nbsp;≤&nbsp;<span class="id" type="var">Y</span><span style='letter-spacing:-.4em;'>}</span>}&nbsp;<span class="nowrap"><span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>-</span></span><span style='letter-spacing:-.2em;'>></span>></span></span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;(3)&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{(<span class="id" type="var">Y</span>&nbsp;-&nbsp;<span class="id" type="var">X</span>)&nbsp;+&nbsp;<span class="id" type="var">X</span>&nbsp;=&nbsp;<span class="id" type="var">Y</span>&nbsp;∨&nbsp;(<span class="id" type="var">Y</span>&nbsp;-&nbsp;<span class="id" type="var">X</span>)&nbsp;+&nbsp;<span class="id" type="var">Y</span>&nbsp;=&nbsp;<span class="id" type="var">X</span><span style='letter-spacing:-.4em;'>}</span>}<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="var">Z</span>&nbsp;<span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>:</span>:</span>=</span>&nbsp;<span class="id" type="var">Y</span>&nbsp;-&nbsp;<span class="id" type="var">X</span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;(4)&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{<span class="id" type="var">Z</span>&nbsp;+&nbsp;<span class="id" type="var">X</span>&nbsp;=&nbsp;<span class="id" type="var">Y</span>&nbsp;∨&nbsp;<span class="id" type="var">Z</span>&nbsp;+&nbsp;<span class="id" type="var">Y</span>&nbsp;=&nbsp;<span class="id" type="var">X</span><span style='letter-spacing:-.4em;'>}</span>}<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="var">ELSE</span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;(5)&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{<span class="id" type="var">True</span>&nbsp;∧&nbsp;~(<span class="id" type="var">X</span>&nbsp;≤&nbsp;<span class="id" type="var">Y</span>)&nbsp;<span style='letter-spacing:-.4em;'>}</span>}&nbsp;<span class="nowrap"><span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>-</span></span><span style='letter-spacing:-.2em;'>></span>></span></span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;(6)&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{(<span class="id" type="var">X</span>&nbsp;-&nbsp;<span class="id" type="var">Y</span>)&nbsp;+&nbsp;<span class="id" type="var">X</span>&nbsp;=&nbsp;<span class="id" type="var">Y</span>&nbsp;∨&nbsp;(<span class="id" type="var">X</span>&nbsp;-&nbsp;<span class="id" type="var">Y</span>)&nbsp;+&nbsp;<span class="id" type="var">Y</span>&nbsp;=&nbsp;<span class="id" type="var">X</span><span style='letter-spacing:-.4em;'>}</span>}<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="var">Z</span>&nbsp;<span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>:</span>:</span>=</span>&nbsp;<span class="id" type="var">X</span>&nbsp;-&nbsp;<span class="id" type="var">Y</span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;(7)&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{<span class="id" type="var">Z</span>&nbsp;+&nbsp;<span class="id" type="var">X</span>&nbsp;=&nbsp;<span class="id" type="var">Y</span>&nbsp;∨&nbsp;<span class="id" type="var">Z</span>&nbsp;+&nbsp;<span class="id" type="var">Y</span>&nbsp;=&nbsp;<span class="id" type="var">X</span><span style='letter-spacing:-.4em;'>}</span>}<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="var">FI</span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;(8)&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{<span class="id" type="var">Z</span>&nbsp;+&nbsp;<span class="id" type="var">X</span>&nbsp;=&nbsp;<span class="id" type="var">Y</span>&nbsp;∨&nbsp;<span class="id" type="var">Z</span>&nbsp;+&nbsp;<span class="id" type="var">Y</span>&nbsp;=&nbsp;<span class="id" type="var">X</span><span style='letter-spacing:-.4em;'>}</span>}
<div class="paragraph"> </div>

</div>
These decorations were constructed as follows:

<div class="paragraph"> </div>

<ul class="doclist">
<li> We start with the outer precondition (1) and postcondition (8).

</li>
<li> We follow the format dictated by the <span class="inlinecode"><span class="id" type="var">hoare_if</span></span> rule and copy the
    postcondition (8) to (4) and (7). We conjoin the precondition (1)
    with the guard of the conditional to obtain (2). We conjoin (1)
    with the negated guard of the conditional to obtain (5).

</li>
<li> In order to use the assignment rule and obtain (3), we substitute
    <span class="inlinecode"><span class="id" type="var">Z</span></span> by <span class="inlinecode"><span class="id" type="var">Y</span></span> <span class="inlinecode">-</span> <span class="inlinecode"><span class="id" type="var">X</span></span> in (4). To obtain (6) we substitute <span class="inlinecode"><span class="id" type="var">Z</span></span> by <span class="inlinecode"><span class="id" type="var">X</span></span> <span class="inlinecode">-</span> <span class="inlinecode"><span class="id" type="var">Y</span></span>
    in (7).

</li>
<li> Finally, we verify that (2) implies (3) and (5) implies (6). Both
    of these implications crucially depend on the ordering of <span class="inlinecode"><span class="id" type="var">X</span></span> and
    <span class="inlinecode"><span class="id" type="var">Y</span></span> obtained from the guard. For instance, knowing that <span class="inlinecode"><span class="id" type="var">X</span></span> <span class="inlinecode">≤</span> <span class="inlinecode"><span class="id" type="var">Y</span></span>
    ensures that subtracting <span class="inlinecode"><span class="id" type="var">X</span></span> from <span class="inlinecode"><span class="id" type="var">Y</span></span> and then adding back <span class="inlinecode"><span class="id" type="var">X</span></span>
    produces <span class="inlinecode"><span class="id" type="var">Y</span></span>, as required by the first disjunct of (3). Similarly,
    knowing that <span class="inlinecode">¬</span> <span class="inlinecode">(<span class="id" type="var">X</span></span> <span class="inlinecode">≤</span> <span class="inlinecode"><span class="id" type="var">Y</span>)</span> ensures that subtracting <span class="inlinecode"><span class="id" type="var">Y</span></span> from <span class="inlinecode"><span class="id" type="var">X</span></span>
    and then adding back <span class="inlinecode"><span class="id" type="var">Y</span></span> produces <span class="inlinecode"><span class="id" type="var">X</span></span>, as needed by the second
    disjunct of (6). Note that <span class="inlinecode"><span class="id" type="var">n</span></span> <span class="inlinecode">-</span> <span class="inlinecode"><span class="id" type="var">m</span></span> <span class="inlinecode">+</span> <span class="inlinecode"><span class="id" type="var">m</span></span> <span class="inlinecode">=</span> <span class="inlinecode"><span class="id" type="var">n</span></span> does <i>not</i> hold for
    arbitrary natural numbers <span class="inlinecode"><span class="id" type="var">n</span></span> and <span class="inlinecode"><span class="id" type="var">m</span></span> (for example, <span class="inlinecode">3</span> <span class="inlinecode">-</span> <span class="inlinecode">5</span> <span class="inlinecode">+</span> <span class="inlinecode">5</span> <span class="inlinecode">=</span>
    <span class="inlinecode">5</span>). 
</li>
</ul>

<div class="paragraph"> </div>

<a name="lab83"></a><h4 class="section">Exercise: 2 stars, standard (if_minus_plus_reloaded)</h4>
 Fill in valid decorations for the following program:

<div class="paragraph"> </div>

<div class="code code-tight">
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{&nbsp;<span class="id" type="var">True</span>&nbsp;<span style='letter-spacing:-.4em;'>}</span>}<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="var">TEST</span>&nbsp;<span class="id" type="var">X</span>&nbsp;≤&nbsp;<span class="id" type="var">Y</span>&nbsp;<span class="id" type="var">THEN</span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>}</span>}&nbsp;<span class="nowrap"><span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>-</span></span><span style='letter-spacing:-.2em;'>></span>></span></span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>}</span>}<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="var">Z</span>&nbsp;<span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>:</span>:</span>=</span>&nbsp;<span class="id" type="var">Y</span>&nbsp;-&nbsp;<span class="id" type="var">X</span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>}</span>}<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="var">ELSE</span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>}</span>}&nbsp;<span class="nowrap"><span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>-</span></span><span style='letter-spacing:-.2em;'>></span>></span></span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>}</span>}<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="var">Y</span>&nbsp;<span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>:</span>:</span>=</span>&nbsp;<span class="id" type="var">X</span>&nbsp;+&nbsp;<span class="id" type="var">Z</span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>}</span>}<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="var">FI</span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{&nbsp;<span class="id" type="var">Y</span>&nbsp;=&nbsp;<span class="id" type="var">X</span>&nbsp;+&nbsp;<span class="id" type="var">Z</span>&nbsp;<span style='letter-spacing:-.4em;'>}</span>}
<div class="paragraph"> </div>

</div>

</div>
<div class="code code-tight">

<span class="comment">(*&nbsp;Do&nbsp;not&nbsp;modify&nbsp;the&nbsp;following&nbsp;line:&nbsp;*)</span><br/>
<span class="id" type="keyword">Definition</span> <span class="id" type="var">manual_grade_for_decorations_in_if_minus_plus_reloaded</span> : <span class="id" type="var">option</span> (<span class="id" type="var">nat</span>*<span class="id" type="var">string</span>) := <span class="id" type="var">None</span>.<br/>
</div>

<span class="proofbox">&#9744;</span> 

<div class="doc">
<a name="lab84"></a><h2 class="section">Example: Reduce to Zero</h2>

<div class="paragraph"> </div>

 Here is a <span class="inlinecode"><span class="id" type="var">WHILE</span></span> loop that is so simple it needs no
    invariant (i.e., the invariant <span class="inlinecode"><span class="id" type="var">True</span></span> will do the job).

<div class="paragraph"> </div>

<div class="code code-tight">
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;(1)&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{&nbsp;<span class="id" type="var">True</span>&nbsp;<span style='letter-spacing:-.4em;'>}</span>}<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="var">WHILE</span>&nbsp;~(<span class="id" type="var">X</span>&nbsp;=&nbsp;0)&nbsp;<span class="id" type="var">DO</span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;(2)&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{&nbsp;<span class="id" type="var">True</span>&nbsp;∧&nbsp;<span class="id" type="var">X</span>&nbsp;≠&nbsp;0&nbsp;<span style='letter-spacing:-.4em;'>}</span>}&nbsp;<span class="nowrap"><span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>-</span></span><span style='letter-spacing:-.2em;'>></span>></span></span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;(3)&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{&nbsp;<span class="id" type="var">True</span>&nbsp;<span style='letter-spacing:-.4em;'>}</span>}<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="var">X</span>&nbsp;<span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>:</span>:</span>=</span>&nbsp;<span class="id" type="var">X</span>&nbsp;-&nbsp;1<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;(4)&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{&nbsp;<span class="id" type="var">True</span>&nbsp;<span style='letter-spacing:-.4em;'>}</span>}<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="var">END</span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;(5)&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{&nbsp;<span class="id" type="var">True</span>&nbsp;∧&nbsp;<span class="id" type="var">X</span>&nbsp;=&nbsp;0&nbsp;<span style='letter-spacing:-.4em;'>}</span>}&nbsp;<span class="nowrap"><span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>-</span></span><span style='letter-spacing:-.2em;'>></span>></span></span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;(6)&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{&nbsp;<span class="id" type="var">X</span>&nbsp;=&nbsp;0&nbsp;<span style='letter-spacing:-.4em;'>}</span>}
<div class="paragraph"> </div>

</div>
The decorations can be constructed as follows:

<div class="paragraph"> </div>

<ul class="doclist">
<li> Start with the outer precondition (1) and postcondition (6).

</li>
<li> Following the format dictated by the <span class="inlinecode"><span class="id" type="var">hoare_while</span></span> rule, we
    copy (1) to (4). We conjoin (1) with the guard to obtain (2) and
    with the negation of the guard to obtain (5). Note that, because
    the outer postcondition (6) does not syntactically match (5), we
    need a trivial use of the consequence rule from (5) to (6).

</li>
<li> Assertion (3) is the same as (4), because <span class="inlinecode"><span class="id" type="var">X</span></span> does not appear in
    <span class="inlinecode">4</span>, so the substitution in the assignment rule is trivial.

</li>
<li> Finally, the implication between (2) and (3) is also trivial. 
</li>
</ul>

<div class="paragraph"> </div>

 From an informal proof in the form of a decorated program, it is
    easy to read off a formal proof using the Coq versions of the
    Hoare rules.  Note that we do <i>not</i> unfold the definition of
    <span class="inlinecode"><span class="id" type="var">hoare_triple</span></span> anywhere in this proof &mdash; the idea is to use the
    Hoare rules as a self-contained logic for reasoning about
    programs. 
</div>
<div class="code code-tight">

<span class="id" type="keyword">Definition</span> <span class="id" type="var">reduce_to_zero'</span> : <span class="id" type="var">com</span> :=<br/>
&nbsp;&nbsp;(<span class="id" type="var">WHILE</span> ~(<span class="id" type="var">X</span> = 0) <span class="id" type="var">DO</span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="var">X</span> <span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>:</span>:</span>=</span> <span class="id" type="var">X</span> - 1<br/>
&nbsp;&nbsp;<span class="id" type="var">END</span>)%<span class="id" type="var">imp</span>.<br/><hr class='doublespaceincode'/>
<span class="id" type="keyword">Theorem</span> <span class="id" type="var">reduce_to_zero_correct'</span> :<br/>
&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{<span class="id" type="keyword">fun</span> <span class="id" type="var">st</span> ⇒ <span class="id" type="var">True</span><span style='letter-spacing:-.4em;'>}</span>}<br/>
&nbsp;&nbsp;<span class="id" type="var">reduce_to_zero'</span><br/>
&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{<span class="id" type="keyword">fun</span> <span class="id" type="var">st</span> ⇒ <span class="id" type="var">st</span> <span class="id" type="var">X</span> = 0<span style='letter-spacing:-.4em;'>}</span>}.<br/>
<div class="togglescript" id="proofcontrol1" onclick="toggleDisplay('proof1');toggleDisplay('proofcontrol1')"><span class="show"></span></div>
<div class="proofscript" id="proof1" onclick="toggleDisplay('proof1');toggleDisplay('proofcontrol1')">
<span class="id" type="keyword">Proof</span>.<br/>
&nbsp;&nbsp;<span class="id" type="tactic">unfold</span> <span class="id" type="var">reduce_to_zero'</span>.<br/>
&nbsp;&nbsp;<span class="comment">(*&nbsp;First&nbsp;we&nbsp;need&nbsp;to&nbsp;transform&nbsp;the&nbsp;postcondition&nbsp;so<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;that&nbsp;hoare_while&nbsp;will&nbsp;apply.&nbsp;*)</span><br/>
&nbsp;&nbsp;<span class="id" type="tactic">eapply</span> <span class="id" type="var">hoare_consequence_post</span>.<br/>
&nbsp;&nbsp;<span class="id" type="tactic">apply</span> <span class="id" type="var">hoare_while</span>.<br/>
&nbsp;&nbsp;- <span class="comment">(*&nbsp;Loop&nbsp;body&nbsp;preserves&nbsp;invariant&nbsp;*)</span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;<span class="comment">(*&nbsp;Need&nbsp;to&nbsp;massage&nbsp;precondition&nbsp;before&nbsp;<span class="inlinecode"><span class="id" type="var">hoare_asgn</span></span>&nbsp;applies&nbsp;*)</span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="tactic">eapply</span> <span class="id" type="var">hoare_consequence_pre</span>. <span class="id" type="tactic">apply</span> <span class="id" type="var">hoare_asgn</span>.<br/>
&nbsp;&nbsp;&nbsp;&nbsp;<span class="comment">(*&nbsp;Proving&nbsp;trivial&nbsp;implication&nbsp;(2)&nbsp;<span class="nowrap"><span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>-</span></span><span style='letter-spacing:-.2em;'>></span>></span></span>&nbsp;(3)&nbsp;*)</span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="tactic">intros</span> <span class="id" type="var">st</span> [<span class="id" type="var">HT</span> <span class="id" type="var">Hbp</span>]. <span class="id" type="tactic">unfold</span> <span class="id" type="var">assn_sub</span>. <span class="id" type="var">constructor</span>.<br/>
&nbsp;&nbsp;- <span class="comment">(*&nbsp;Invariant&nbsp;and&nbsp;negated&nbsp;guard&nbsp;imply&nbsp;postcondition&nbsp;*)</span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="tactic">intros</span> <span class="id" type="var">st</span> [<span class="id" type="var">Inv</span> <span class="id" type="var">GuardFalse</span>].<br/>
&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="tactic">unfold</span> <span class="id" type="var">bassn</span> <span class="id" type="keyword">in</span> <span class="id" type="var">GuardFalse</span>. <span class="id" type="tactic">simpl</span> <span class="id" type="keyword">in</span> <span class="id" type="var">GuardFalse</span>.<br/>
&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="tactic">rewrite</span> <span class="id" type="var">not_true_iff_false</span> <span class="id" type="keyword">in</span> <span class="id" type="var">GuardFalse</span>.<br/>
&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="tactic">rewrite</span> <span class="id" type="var">negb_false_iff</span> <span class="id" type="keyword">in</span> <span class="id" type="var">GuardFalse</span>.<br/>
&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="tactic">apply</span> <span class="id" type="var">eqb_eq</span> <span class="id" type="keyword">in</span> <span class="id" type="var">GuardFalse</span>.<br/>
&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="tactic">apply</span> <span class="id" type="var">GuardFalse</span>. <span class="id" type="keyword">Qed</span>.<br/>
</div>
</div>

<div class="doc">
<a name="lab85"></a><h2 class="section">Example: Division</h2>

<div class="paragraph"> </div>

 The following Imp program calculates the integer quotient and
    remainder of two numbers <span class="inlinecode"><span class="id" type="var">m</span></span> and <span class="inlinecode"><span class="id" type="var">n</span></span> that are arbitrary constants
    in the program.

<div class="paragraph"> </div>

<div class="code code-tight">
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="var">X</span>&nbsp;<span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>:</span>:</span>=</span>&nbsp;<span class="id" type="var">m</span>;;<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="var">Y</span>&nbsp;<span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>:</span>:</span>=</span>&nbsp;0;;<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="var">WHILE</span>&nbsp;<span class="id" type="var">n</span>&nbsp;≤&nbsp;<span class="id" type="var">X</span>&nbsp;<span class="id" type="var">DO</span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="var">X</span>&nbsp;<span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>:</span>:</span>=</span>&nbsp;<span class="id" type="var">X</span>&nbsp;-&nbsp;<span class="id" type="var">n</span>;;<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="var">Y</span>&nbsp;<span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>:</span>:</span>=</span>&nbsp;<span class="id" type="var">Y</span>&nbsp;+&nbsp;1<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="var">END</span>;
<div class="paragraph"> </div>

</div>
    In we replace <span class="inlinecode"><span class="id" type="var">m</span></span> and <span class="inlinecode"><span class="id" type="var">n</span></span> by concrete numbers and execute the
    program, it will terminate with the variable <span class="inlinecode"><span class="id" type="var">X</span></span> set to the
    remainder when <span class="inlinecode"><span class="id" type="var">m</span></span> is divided by <span class="inlinecode"><span class="id" type="var">n</span></span> and <span class="inlinecode"><span class="id" type="var">Y</span></span> set to the
    quotient. 
<div class="paragraph"> </div>

 In order to give a specification to this program we need to
    remember that dividing <span class="inlinecode"><span class="id" type="var">m</span></span> by <span class="inlinecode"><span class="id" type="var">n</span></span> produces a remainder <span class="inlinecode"><span class="id" type="var">X</span></span> and a
    quotient <span class="inlinecode"><span class="id" type="var">Y</span></span> such that <span class="inlinecode"><span class="id" type="var">n</span></span> <span class="inlinecode">*</span> <span class="inlinecode"><span class="id" type="var">Y</span></span> <span class="inlinecode">+</span> <span class="inlinecode"><span class="id" type="var">X</span></span> <span class="inlinecode">=</span> <span class="inlinecode"><span class="id" type="var">m</span></span> <span class="inlinecode">∧</span> <span class="inlinecode"><span class="id" type="var">X</span></span> <span class="inlinecode">&lt;</span> <span class="inlinecode"><span class="id" type="var">n</span></span>.

<div class="paragraph"> </div>

    It turns out that we get lucky with this program and don't have to
    think very hard about the loop invariant: the invariant is just
    the first conjunct <span class="inlinecode"><span class="id" type="var">n</span></span> <span class="inlinecode">*</span> <span class="inlinecode"><span class="id" type="var">Y</span></span> <span class="inlinecode">+</span> <span class="inlinecode"><span class="id" type="var">X</span></span> <span class="inlinecode">=</span> <span class="inlinecode"><span class="id" type="var">m</span></span>, and we can use this to
    decorate the program.

<div class="paragraph"> </div>

<div class="code code-tight">
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;(1)&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{&nbsp;<span class="id" type="var">True</span>&nbsp;<span style='letter-spacing:-.4em;'>}</span>}&nbsp;<span class="nowrap"><span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>-</span></span><span style='letter-spacing:-.2em;'>></span>></span></span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;(2)&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{&nbsp;<span class="id" type="var">n</span>&nbsp;*&nbsp;0&nbsp;+&nbsp;<span class="id" type="var">m</span>&nbsp;=&nbsp;<span class="id" type="var">m</span>&nbsp;<span style='letter-spacing:-.4em;'>}</span>}<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="var">X</span>&nbsp;<span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>:</span>:</span>=</span>&nbsp;<span class="id" type="var">m</span>;;<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;(3)&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{&nbsp;<span class="id" type="var">n</span>&nbsp;*&nbsp;0&nbsp;+&nbsp;<span class="id" type="var">X</span>&nbsp;=&nbsp;<span class="id" type="var">m</span>&nbsp;<span style='letter-spacing:-.4em;'>}</span>}<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="var">Y</span>&nbsp;<span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>:</span>:</span>=</span>&nbsp;0;;<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;(4)&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{&nbsp;<span class="id" type="var">n</span>&nbsp;*&nbsp;<span class="id" type="var">Y</span>&nbsp;+&nbsp;<span class="id" type="var">X</span>&nbsp;=&nbsp;<span class="id" type="var">m</span>&nbsp;<span style='letter-spacing:-.4em;'>}</span>}<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="var">WHILE</span>&nbsp;<span class="id" type="var">n</span>&nbsp;≤&nbsp;<span class="id" type="var">X</span>&nbsp;<span class="id" type="var">DO</span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;(5)&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{&nbsp;<span class="id" type="var">n</span>&nbsp;*&nbsp;<span class="id" type="var">Y</span>&nbsp;+&nbsp;<span class="id" type="var">X</span>&nbsp;=&nbsp;<span class="id" type="var">m</span>&nbsp;∧&nbsp;<span class="id" type="var">n</span>&nbsp;≤&nbsp;<span class="id" type="var">X</span>&nbsp;<span style='letter-spacing:-.4em;'>}</span>}&nbsp;<span class="nowrap"><span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>-</span></span><span style='letter-spacing:-.2em;'>></span>></span></span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;(6)&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{&nbsp;<span class="id" type="var">n</span>&nbsp;*&nbsp;(<span class="id" type="var">Y</span>&nbsp;+&nbsp;1)&nbsp;+&nbsp;(<span class="id" type="var">X</span>&nbsp;-&nbsp;<span class="id" type="var">n</span>)&nbsp;=&nbsp;<span class="id" type="var">m</span>&nbsp;<span style='letter-spacing:-.4em;'>}</span>}<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="var">X</span>&nbsp;<span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>:</span>:</span>=</span>&nbsp;<span class="id" type="var">X</span>&nbsp;-&nbsp;<span class="id" type="var">n</span>;;<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;(7)&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{&nbsp;<span class="id" type="var">n</span>&nbsp;*&nbsp;(<span class="id" type="var">Y</span>&nbsp;+&nbsp;1)&nbsp;+&nbsp;<span class="id" type="var">X</span>&nbsp;=&nbsp;<span class="id" type="var">m</span>&nbsp;<span style='letter-spacing:-.4em;'>}</span>}<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="var">Y</span>&nbsp;<span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>:</span>:</span>=</span>&nbsp;<span class="id" type="var">Y</span>&nbsp;+&nbsp;1<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;(8)&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{&nbsp;<span class="id" type="var">n</span>&nbsp;*&nbsp;<span class="id" type="var">Y</span>&nbsp;+&nbsp;<span class="id" type="var">X</span>&nbsp;=&nbsp;<span class="id" type="var">m</span>&nbsp;<span style='letter-spacing:-.4em;'>}</span>}<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="var">END</span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;(9)&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{&nbsp;<span class="id" type="var">n</span>&nbsp;*&nbsp;<span class="id" type="var">Y</span>&nbsp;+&nbsp;<span class="id" type="var">X</span>&nbsp;=&nbsp;<span class="id" type="var">m</span>&nbsp;∧&nbsp;<span class="id" type="var">X</span>&nbsp;&lt;&nbsp;<span class="id" type="var">n</span>&nbsp;<span style='letter-spacing:-.4em;'>}</span>}
<div class="paragraph"> </div>

</div>
    Assertions (4), (5), (8), and (9) are derived mechanically from
    the invariant and the loop's guard.  Assertions (8), (7), and (6)
    are derived using the assignment rule going backwards from (8)
    to (6).  Assertions (4), (3), and (2) are again backwards
    applications of the assignment rule.

<div class="paragraph"> </div>

    Now that we've decorated the program it only remains to check that
    the two uses of the consequence rule are correct &mdash; i.e., that (1)
    implies (2) and that (5) implies (6).  This is indeed the case, so
    we have a valid decorated program. 
</div>

<div class="doc">
<a name="lab86"></a><h1 class="section">Finding Loop Invariants</h1>

<div class="paragraph"> </div>

 Once the outermost precondition and postcondition are
    chosen, the only creative part in verifying programs using Hoare
    Logic is finding the right loop invariants.  The reason this is
    difficult is the same as the reason that inductive mathematical
    proofs are: strengthening the loop invariant (or the induction
    hypothesis) means that you have a stronger assumption to work with
    when trying to establish the postcondition of the loop body (or
    complete the induction step of the proof), but it also means that
    the loop body's postcondition (or the statement being proved
    inductively) is stronger and thus harder to prove!

<div class="paragraph"> </div>

    This section explains how to approach the challenge of finding loop
    invariants through a series of examples and exercises. 
<div class="paragraph"> </div>

<a name="lab87"></a><h2 class="section">Example: Slow Subtraction</h2>

<div class="paragraph"> </div>

 The following program subtracts the value of <span class="inlinecode"><span class="id" type="var">X</span></span> from the value of
    <span class="inlinecode"><span class="id" type="var">Y</span></span> by repeatedly decrementing both <span class="inlinecode"><span class="id" type="var">X</span></span> and <span class="inlinecode"><span class="id" type="var">Y</span></span>.  We want to verify its
    correctness with respect to the pre- and postconditions shown:

<div class="paragraph"> </div>

<div class="code code-tight">
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{&nbsp;<span class="id" type="var">X</span>&nbsp;=&nbsp;<span class="id" type="var">m</span>&nbsp;∧&nbsp;<span class="id" type="var">Y</span>&nbsp;=&nbsp;<span class="id" type="var">n</span>&nbsp;<span style='letter-spacing:-.4em;'>}</span>}<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="var">WHILE</span>&nbsp;~(<span class="id" type="var">X</span>&nbsp;=&nbsp;0)&nbsp;<span class="id" type="var">DO</span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="var">Y</span>&nbsp;<span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>:</span>:</span>=</span>&nbsp;<span class="id" type="var">Y</span>&nbsp;-&nbsp;1;;<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="var">X</span>&nbsp;<span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>:</span>:</span>=</span>&nbsp;<span class="id" type="var">X</span>&nbsp;-&nbsp;1<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="var">END</span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{&nbsp;<span class="id" type="var">Y</span>&nbsp;=&nbsp;<span class="id" type="var">n</span>&nbsp;-&nbsp;<span class="id" type="var">m</span>&nbsp;<span style='letter-spacing:-.4em;'>}</span>}
<div class="paragraph"> </div>

</div>

<div class="paragraph"> </div>

 To verify this program, we need to find an invariant <span class="inlinecode"><span class="id" type="var">Inv</span></span> for the
    loop.  As a first step we can leave <span class="inlinecode"><span class="id" type="var">Inv</span></span> as an unknown and build a
    <i>skeleton</i> for the proof by applying the rules for local
    consistency (working from the end of the program to the beginning,
    as usual, and without any thinking at all yet). 

<div class="paragraph"> </div>

    This leads to the following skeleton:

<div class="paragraph"> </div>

<div class="code code-tight">
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;(1)&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{&nbsp;<span class="id" type="var">X</span>&nbsp;=&nbsp;<span class="id" type="var">m</span>&nbsp;∧&nbsp;<span class="id" type="var">Y</span>&nbsp;=&nbsp;<span class="id" type="var">n</span>&nbsp;<span style='letter-spacing:-.4em;'>}</span>}&nbsp;&nbsp;<span class="nowrap"><span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>-</span></span><span style='letter-spacing:-.2em;'>></span>></span></span>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;(<span class="id" type="var">a</span>)<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;(2)&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{&nbsp;<span class="id" type="var">Inv</span>&nbsp;<span style='letter-spacing:-.4em;'>}</span>}<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="var">WHILE</span>&nbsp;~(<span class="id" type="var">X</span>&nbsp;=&nbsp;0)&nbsp;<span class="id" type="var">DO</span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;(3)&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{&nbsp;<span class="id" type="var">Inv</span>&nbsp;∧&nbsp;<span class="id" type="var">X</span>&nbsp;≠&nbsp;0&nbsp;<span style='letter-spacing:-.4em;'>}</span>}&nbsp;&nbsp;<span class="nowrap"><span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>-</span></span><span style='letter-spacing:-.2em;'>></span>></span></span>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;(<span class="id" type="var">c</span>)<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;(4)&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{&nbsp;<span class="id" type="var">Inv</span>&nbsp;[<span class="id" type="var">X</span>&nbsp;<span class="nowrap"><span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>&#x22A2;</span><span style='font-size:90%;'>&gt;</span></span></span></span>&nbsp;<span class="id" type="var">X</span>-1]&nbsp;[<span class="id" type="var">Y</span>&nbsp;<span class="nowrap"><span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>&#x22A2;</span><span style='font-size:90%;'>&gt;</span></span></span></span>&nbsp;<span class="id" type="var">Y</span>-1]&nbsp;<span style='letter-spacing:-.4em;'>}</span>}<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="var">Y</span>&nbsp;<span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>:</span>:</span>=</span>&nbsp;<span class="id" type="var">Y</span>&nbsp;-&nbsp;1;;<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;(5)&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{&nbsp;<span class="id" type="var">Inv</span>&nbsp;[<span class="id" type="var">X</span>&nbsp;<span class="nowrap"><span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>&#x22A2;</span><span style='font-size:90%;'>&gt;</span></span></span></span>&nbsp;<span class="id" type="var">X</span>-1]&nbsp;<span style='letter-spacing:-.4em;'>}</span>}<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="var">X</span>&nbsp;<span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>:</span>:</span>=</span>&nbsp;<span class="id" type="var">X</span>&nbsp;-&nbsp;1<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;(6)&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{&nbsp;<span class="id" type="var">Inv</span>&nbsp;<span style='letter-spacing:-.4em;'>}</span>}<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="var">END</span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;(7)&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{&nbsp;<span class="id" type="var">Inv</span>&nbsp;∧&nbsp;¬(<span class="id" type="var">X</span>&nbsp;≠&nbsp;0)&nbsp;<span style='letter-spacing:-.4em;'>}</span>}&nbsp;&nbsp;<span class="nowrap"><span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>-</span></span><span style='letter-spacing:-.2em;'>></span>></span></span>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;(<span class="id" type="var">b</span>)<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;(8)&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{&nbsp;<span class="id" type="var">Y</span>&nbsp;=&nbsp;<span class="id" type="var">n</span>&nbsp;-&nbsp;<span class="id" type="var">m</span>&nbsp;<span style='letter-spacing:-.4em;'>}</span>}
<div class="paragraph"> </div>

</div>
    By examining this skeleton, we can see that any valid <span class="inlinecode"><span class="id" type="var">Inv</span></span> will
    have to respect three conditions:

<div class="paragraph"> </div>

<ul class="doclist">
<li> (a) it must be <i>weak</i> enough to be implied by the loop's
      precondition, i.e., (1) must imply (2);

</li>
<li> (b) it must be <i>strong</i> enough to imply the program's postcondition,
      i.e., (7) must imply (8);

</li>
<li> (c) it must be <i>preserved</i> by each iteration of the loop (given 
      that the loop guard evaluates to true), i.e., (3) must imply (4). 
</li>
</ul>

<div class="paragraph"> </div>

 These conditions are actually independent of the particular
    program and specification we are considering. Indeed, every loop
    invariant has to satisfy them. One way to find an invariant that
    simultaneously satisfies these three conditions is by using an
    iterative process: start with a "candidate" invariant (e.g., a
    guess or a heuristic choice) and check the three conditions above;
    if any of the checks fails, try to use the information that we get
    from the failure to produce another &mdash; hopefully better &mdash; candidate
    invariant, and repeat.

<div class="paragraph"> </div>

    For instance, in the reduce-to-zero example above, we saw that,
    for a very simple loop, choosing <span class="inlinecode"><span class="id" type="var">True</span></span> as an invariant did the
    job.  So let's try instantiating <span class="inlinecode"><span class="id" type="var">Inv</span></span> with <span class="inlinecode"><span class="id" type="var">True</span></span> in the skeleton
    above and see what we get...

<div class="paragraph"> </div>

<div class="code code-tight">
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;(1)&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{&nbsp;<span class="id" type="var">X</span>&nbsp;=&nbsp;<span class="id" type="var">m</span>&nbsp;∧&nbsp;<span class="id" type="var">Y</span>&nbsp;=&nbsp;<span class="id" type="var">n</span>&nbsp;<span style='letter-spacing:-.4em;'>}</span>}&nbsp;<span class="nowrap"><span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>-</span></span><span style='letter-spacing:-.2em;'>></span>></span></span>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;(<span class="id" type="var">a</span>&nbsp;-&nbsp;<span class="id" type="var">OK</span>)<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;(2)&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{&nbsp;<span class="id" type="var">True</span>&nbsp;<span style='letter-spacing:-.4em;'>}</span>}<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="var">WHILE</span>&nbsp;~(<span class="id" type="var">X</span>&nbsp;=&nbsp;0)&nbsp;<span class="id" type="var">DO</span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;(3)&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{&nbsp;<span class="id" type="var">True</span>&nbsp;∧&nbsp;<span class="id" type="var">X</span>&nbsp;≠&nbsp;0&nbsp;<span style='letter-spacing:-.4em;'>}</span>}&nbsp;&nbsp;<span class="nowrap"><span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>-</span></span><span style='letter-spacing:-.2em;'>></span>></span></span>&nbsp;&nbsp;&nbsp;&nbsp;(<span class="id" type="var">c</span>&nbsp;-&nbsp;<span class="id" type="var">OK</span>)<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;(4)&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{&nbsp;<span class="id" type="var">True</span>&nbsp;<span style='letter-spacing:-.4em;'>}</span>}<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="var">Y</span>&nbsp;<span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>:</span>:</span>=</span>&nbsp;<span class="id" type="var">Y</span>&nbsp;-&nbsp;1;;<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;(5)&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{&nbsp;<span class="id" type="var">True</span>&nbsp;<span style='letter-spacing:-.4em;'>}</span>}<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="var">X</span>&nbsp;<span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>:</span>:</span>=</span>&nbsp;<span class="id" type="var">X</span>&nbsp;-&nbsp;1<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;(6)&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{&nbsp;<span class="id" type="var">True</span>&nbsp;<span style='letter-spacing:-.4em;'>}</span>}<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="var">END</span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;(7)&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{&nbsp;<span class="id" type="var">True</span>&nbsp;∧&nbsp;<span class="id" type="var">X</span>&nbsp;=&nbsp;0&nbsp;<span style='letter-spacing:-.4em;'>}</span>}&nbsp;&nbsp;<span class="nowrap"><span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>-</span></span><span style='letter-spacing:-.2em;'>></span>></span></span>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;(<span class="id" type="var">b</span>&nbsp;-&nbsp;<span class="id" type="var">WRONG</span>!)<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;(8)&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{&nbsp;<span class="id" type="var">Y</span>&nbsp;=&nbsp;<span class="id" type="var">n</span>&nbsp;-&nbsp;<span class="id" type="var">m</span>&nbsp;<span style='letter-spacing:-.4em;'>}</span>}
<div class="paragraph"> </div>

</div>
    While conditions (a) and (c) are trivially satisfied, condition
    (b) is wrong, i.e., it is not the case that <span class="inlinecode"><span class="id" type="var">True</span></span> <span class="inlinecode">∧</span> <span class="inlinecode"><span class="id" type="var">X</span></span> <span class="inlinecode">=</span> <span class="inlinecode">0</span> (7)
    implies <span class="inlinecode"><span class="id" type="var">Y</span></span> <span class="inlinecode">=</span> <span class="inlinecode"><span class="id" type="var">n</span></span> <span class="inlinecode">-</span> <span class="inlinecode"><span class="id" type="var">m</span></span> (8).  In fact, the two assertions are
    completely unrelated, so it is very easy to find a counterexample
    to the implication (say, <span class="inlinecode"><span class="id" type="var">Y</span></span> <span class="inlinecode">=</span> <span class="inlinecode"><span class="id" type="var">X</span></span> <span class="inlinecode">=</span> <span class="inlinecode"><span class="id" type="var">m</span></span> <span class="inlinecode">=</span> <span class="inlinecode">0</span> and <span class="inlinecode"><span class="id" type="var">n</span></span> <span class="inlinecode">=</span> <span class="inlinecode">1</span>).

<div class="paragraph"> </div>

    If we want (b) to hold, we need to strengthen the invariant so
    that it implies the postcondition (8).  One simple way to do
    this is to let the invariant <i>be</i> the postcondition.  So let's
    return to our skeleton, instantiate <span class="inlinecode"><span class="id" type="var">Inv</span></span> with <span class="inlinecode"><span class="id" type="var">Y</span></span> <span class="inlinecode">=</span> <span class="inlinecode"><span class="id" type="var">n</span></span> <span class="inlinecode">-</span> <span class="inlinecode"><span class="id" type="var">m</span></span>, and
    check conditions (a) to (c) again.

<div class="paragraph"> </div>

<div class="code code-tight">
&nbsp;&nbsp;&nbsp;&nbsp;(1)&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{&nbsp;<span class="id" type="var">X</span>&nbsp;=&nbsp;<span class="id" type="var">m</span>&nbsp;∧&nbsp;<span class="id" type="var">Y</span>&nbsp;=&nbsp;<span class="id" type="var">n</span>&nbsp;<span style='letter-spacing:-.4em;'>}</span>}&nbsp;&nbsp;<span class="nowrap"><span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>-</span></span><span style='letter-spacing:-.2em;'>></span>></span></span>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;(<span class="id" type="var">a</span>&nbsp;-&nbsp;<span class="id" type="var">WRONG</span>!)<br/>
&nbsp;&nbsp;&nbsp;&nbsp;(2)&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{&nbsp;<span class="id" type="var">Y</span>&nbsp;=&nbsp;<span class="id" type="var">n</span>&nbsp;-&nbsp;<span class="id" type="var">m</span>&nbsp;<span style='letter-spacing:-.4em;'>}</span>}<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="var">WHILE</span>&nbsp;~(<span class="id" type="var">X</span>&nbsp;=&nbsp;0)&nbsp;<span class="id" type="var">DO</span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;(3)&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{&nbsp;<span class="id" type="var">Y</span>&nbsp;=&nbsp;<span class="id" type="var">n</span>&nbsp;-&nbsp;<span class="id" type="var">m</span>&nbsp;∧&nbsp;<span class="id" type="var">X</span>&nbsp;≠&nbsp;0&nbsp;<span style='letter-spacing:-.4em;'>}</span>}&nbsp;&nbsp;<span class="nowrap"><span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>-</span></span><span style='letter-spacing:-.2em;'>></span>></span></span>&nbsp;&nbsp;&nbsp;(<span class="id" type="var">c</span>&nbsp;-&nbsp;<span class="id" type="var">WRONG</span>!)<br/>
&nbsp;&nbsp;&nbsp;&nbsp;(4)&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{&nbsp;<span class="id" type="var">Y</span>&nbsp;-&nbsp;1&nbsp;=&nbsp;<span class="id" type="var">n</span>&nbsp;-&nbsp;<span class="id" type="var">m</span>&nbsp;<span style='letter-spacing:-.4em;'>}</span>}<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="var">Y</span>&nbsp;<span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>:</span>:</span>=</span>&nbsp;<span class="id" type="var">Y</span>&nbsp;-&nbsp;1;;<br/>
&nbsp;&nbsp;&nbsp;&nbsp;(5)&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{&nbsp;<span class="id" type="var">Y</span>&nbsp;=&nbsp;<span class="id" type="var">n</span>&nbsp;-&nbsp;<span class="id" type="var">m</span>&nbsp;<span style='letter-spacing:-.4em;'>}</span>}<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="var">X</span>&nbsp;<span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>:</span>:</span>=</span>&nbsp;<span class="id" type="var">X</span>&nbsp;-&nbsp;1<br/>
&nbsp;&nbsp;&nbsp;&nbsp;(6)&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{&nbsp;<span class="id" type="var">Y</span>&nbsp;=&nbsp;<span class="id" type="var">n</span>&nbsp;-&nbsp;<span class="id" type="var">m</span>&nbsp;<span style='letter-spacing:-.4em;'>}</span>}<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="var">END</span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;(7)&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{&nbsp;<span class="id" type="var">Y</span>&nbsp;=&nbsp;<span class="id" type="var">n</span>&nbsp;-&nbsp;<span class="id" type="var">m</span>&nbsp;∧&nbsp;<span class="id" type="var">X</span>&nbsp;=&nbsp;0&nbsp;<span style='letter-spacing:-.4em;'>}</span>}&nbsp;&nbsp;<span class="nowrap"><span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>-</span></span><span style='letter-spacing:-.2em;'>></span>></span></span>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;(<span class="id" type="var">b</span>&nbsp;-&nbsp;<span class="id" type="var">OK</span>)<br/>
&nbsp;&nbsp;&nbsp;&nbsp;(8)&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{&nbsp;<span class="id" type="var">Y</span>&nbsp;=&nbsp;<span class="id" type="var">n</span>&nbsp;-&nbsp;<span class="id" type="var">m</span>&nbsp;<span style='letter-spacing:-.4em;'>}</span>}
<div class="paragraph"> </div>

</div>
    This time, condition (b) holds trivially, but (a) and (c) are
    broken. Condition (a) requires that (1) <span class="inlinecode"><span class="id" type="var">X</span></span> <span class="inlinecode">=</span> <span class="inlinecode"><span class="id" type="var">m</span></span> <span class="inlinecode">∧</span> <span class="inlinecode"><span class="id" type="var">Y</span></span> <span class="inlinecode">=</span> <span class="inlinecode"><span class="id" type="var">n</span></span>
    implies (2) <span class="inlinecode"><span class="id" type="var">Y</span></span> <span class="inlinecode">=</span> <span class="inlinecode"><span class="id" type="var">n</span></span> <span class="inlinecode">-</span> <span class="inlinecode"><span class="id" type="var">m</span></span>.  If we substitute <span class="inlinecode"><span class="id" type="var">Y</span></span> by <span class="inlinecode"><span class="id" type="var">n</span></span> we have to
    show that <span class="inlinecode"><span class="id" type="var">n</span></span> <span class="inlinecode">=</span> <span class="inlinecode"><span class="id" type="var">n</span></span> <span class="inlinecode">-</span> <span class="inlinecode"><span class="id" type="var">m</span></span> for arbitrary <span class="inlinecode"><span class="id" type="var">m</span></span> and <span class="inlinecode"><span class="id" type="var">n</span></span>, which is not
    the case (for instance, when <span class="inlinecode"><span class="id" type="var">m</span></span> <span class="inlinecode">=</span> <span class="inlinecode"><span class="id" type="var">n</span></span> <span class="inlinecode">=</span> <span class="inlinecode">1</span>).  Condition (c) requires
    that <span class="inlinecode"><span class="id" type="var">n</span></span> <span class="inlinecode">-</span> <span class="inlinecode"><span class="id" type="var">m</span></span> <span class="inlinecode">-</span> <span class="inlinecode">1</span> <span class="inlinecode">=</span> <span class="inlinecode"><span class="id" type="var">n</span></span> <span class="inlinecode">-</span> <span class="inlinecode"><span class="id" type="var">m</span></span>, which fails, for instance, for <span class="inlinecode"><span class="id" type="var">n</span></span> <span class="inlinecode">=</span> <span class="inlinecode">1</span>
    and <span class="inlinecode"><span class="id" type="var">m</span></span> <span class="inlinecode">=</span> <span class="inlinecode">0</span>. So, although <span class="inlinecode"><span class="id" type="var">Y</span></span> <span class="inlinecode">=</span> <span class="inlinecode"><span class="id" type="var">n</span></span> <span class="inlinecode">-</span> <span class="inlinecode"><span class="id" type="var">m</span></span> holds at the end of the loop,
    it does not hold from the start, and it doesn't hold on each
    iteration; it is not a correct invariant.

<div class="paragraph"> </div>

    This failure is not very surprising: the variable <span class="inlinecode"><span class="id" type="var">Y</span></span> changes
    during the loop, while <span class="inlinecode"><span class="id" type="var">m</span></span> and <span class="inlinecode"><span class="id" type="var">n</span></span> are constant, so the assertion
    we chose didn't have much chance of being an invariant!

<div class="paragraph"> </div>

    To do better, we need to generalize (8) to some statement that is
    equivalent to (8) when <span class="inlinecode"><span class="id" type="var">X</span></span> is <span class="inlinecode">0</span>, since this will be the case
    when the loop terminates, and that "fills the gap" in some
    appropriate way when <span class="inlinecode"><span class="id" type="var">X</span></span> is nonzero.  Looking at how the loop
    works, we can observe that <span class="inlinecode"><span class="id" type="var">X</span></span> and <span class="inlinecode"><span class="id" type="var">Y</span></span> are decremented together
    until <span class="inlinecode"><span class="id" type="var">X</span></span> reaches <span class="inlinecode">0</span>.  So, if <span class="inlinecode"><span class="id" type="var">X</span></span> <span class="inlinecode">=</span> <span class="inlinecode">2</span> and <span class="inlinecode"><span class="id" type="var">Y</span></span> <span class="inlinecode">=</span> <span class="inlinecode">5</span> initially,
    after one iteration of the loop we obtain <span class="inlinecode"><span class="id" type="var">X</span></span> <span class="inlinecode">=</span> <span class="inlinecode">1</span> and <span class="inlinecode"><span class="id" type="var">Y</span></span> <span class="inlinecode">=</span> <span class="inlinecode">4</span>;
    after two iterations <span class="inlinecode"><span class="id" type="var">X</span></span> <span class="inlinecode">=</span> <span class="inlinecode">0</span> and <span class="inlinecode"><span class="id" type="var">Y</span></span> <span class="inlinecode">=</span> <span class="inlinecode">3</span>; and then the loop stops.
    Notice that the difference between <span class="inlinecode"><span class="id" type="var">Y</span></span> and <span class="inlinecode"><span class="id" type="var">X</span></span> stays constant
    between iterations: initially, <span class="inlinecode"><span class="id" type="var">Y</span></span> <span class="inlinecode">=</span> <span class="inlinecode"><span class="id" type="var">n</span></span> and <span class="inlinecode"><span class="id" type="var">X</span></span> <span class="inlinecode">=</span> <span class="inlinecode"><span class="id" type="var">m</span></span>, and the
    difference is always <span class="inlinecode"><span class="id" type="var">n</span></span> <span class="inlinecode">-</span> <span class="inlinecode"><span class="id" type="var">m</span></span>.  So let's try instantiating <span class="inlinecode"><span class="id" type="var">Inv</span></span> in
    the skeleton above with <span class="inlinecode"><span class="id" type="var">Y</span></span> <span class="inlinecode">-</span> <span class="inlinecode"><span class="id" type="var">X</span></span> <span class="inlinecode">=</span> <span class="inlinecode"><span class="id" type="var">n</span></span> <span class="inlinecode">-</span> <span class="inlinecode"><span class="id" type="var">m</span></span>.

<div class="paragraph"> </div>

<div class="code code-tight">
&nbsp;&nbsp;&nbsp;&nbsp;(1)&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{&nbsp;<span class="id" type="var">X</span>&nbsp;=&nbsp;<span class="id" type="var">m</span>&nbsp;∧&nbsp;<span class="id" type="var">Y</span>&nbsp;=&nbsp;<span class="id" type="var">n</span>&nbsp;<span style='letter-spacing:-.4em;'>}</span>}&nbsp;&nbsp;<span class="nowrap"><span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>-</span></span><span style='letter-spacing:-.2em;'>></span>></span></span>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;(<span class="id" type="var">a</span>&nbsp;-&nbsp;<span class="id" type="var">OK</span>)<br/>
&nbsp;&nbsp;&nbsp;&nbsp;(2)&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{&nbsp;<span class="id" type="var">Y</span>&nbsp;-&nbsp;<span class="id" type="var">X</span>&nbsp;=&nbsp;<span class="id" type="var">n</span>&nbsp;-&nbsp;<span class="id" type="var">m</span>&nbsp;<span style='letter-spacing:-.4em;'>}</span>}<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="var">WHILE</span>&nbsp;~(<span class="id" type="var">X</span>&nbsp;=&nbsp;0)&nbsp;<span class="id" type="var">DO</span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;(3)&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{&nbsp;<span class="id" type="var">Y</span>&nbsp;-&nbsp;<span class="id" type="var">X</span>&nbsp;=&nbsp;<span class="id" type="var">n</span>&nbsp;-&nbsp;<span class="id" type="var">m</span>&nbsp;∧&nbsp;<span class="id" type="var">X</span>&nbsp;≠&nbsp;0&nbsp;<span style='letter-spacing:-.4em;'>}</span>}&nbsp;&nbsp;<span class="nowrap"><span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>-</span></span><span style='letter-spacing:-.2em;'>></span>></span></span>&nbsp;&nbsp;&nbsp;&nbsp;(<span class="id" type="var">c</span>&nbsp;-&nbsp;<span class="id" type="var">OK</span>)<br/>
&nbsp;&nbsp;&nbsp;&nbsp;(4)&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{&nbsp;(<span class="id" type="var">Y</span>&nbsp;-&nbsp;1)&nbsp;-&nbsp;(<span class="id" type="var">X</span>&nbsp;-&nbsp;1)&nbsp;=&nbsp;<span class="id" type="var">n</span>&nbsp;-&nbsp;<span class="id" type="var">m</span>&nbsp;<span style='letter-spacing:-.4em;'>}</span>}<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="var">Y</span>&nbsp;<span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>:</span>:</span>=</span>&nbsp;<span class="id" type="var">Y</span>&nbsp;-&nbsp;1;;<br/>
&nbsp;&nbsp;&nbsp;&nbsp;(5)&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{&nbsp;<span class="id" type="var">Y</span>&nbsp;-&nbsp;(<span class="id" type="var">X</span>&nbsp;-&nbsp;1)&nbsp;=&nbsp;<span class="id" type="var">n</span>&nbsp;-&nbsp;<span class="id" type="var">m</span>&nbsp;<span style='letter-spacing:-.4em;'>}</span>}<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="var">X</span>&nbsp;<span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>:</span>:</span>=</span>&nbsp;<span class="id" type="var">X</span>&nbsp;-&nbsp;1<br/>
&nbsp;&nbsp;&nbsp;&nbsp;(6)&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{&nbsp;<span class="id" type="var">Y</span>&nbsp;-&nbsp;<span class="id" type="var">X</span>&nbsp;=&nbsp;<span class="id" type="var">n</span>&nbsp;-&nbsp;<span class="id" type="var">m</span>&nbsp;<span style='letter-spacing:-.4em;'>}</span>}<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="var">END</span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;(7)&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{&nbsp;<span class="id" type="var">Y</span>&nbsp;-&nbsp;<span class="id" type="var">X</span>&nbsp;=&nbsp;<span class="id" type="var">n</span>&nbsp;-&nbsp;<span class="id" type="var">m</span>&nbsp;∧&nbsp;<span class="id" type="var">X</span>&nbsp;=&nbsp;0&nbsp;<span style='letter-spacing:-.4em;'>}</span>}&nbsp;&nbsp;<span class="nowrap"><span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>-</span></span><span style='letter-spacing:-.2em;'>></span>></span></span>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;(<span class="id" type="var">b</span>&nbsp;-&nbsp;<span class="id" type="var">OK</span>)<br/>
&nbsp;&nbsp;&nbsp;&nbsp;(8)&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{&nbsp;<span class="id" type="var">Y</span>&nbsp;=&nbsp;<span class="id" type="var">n</span>&nbsp;-&nbsp;<span class="id" type="var">m</span>&nbsp;<span style='letter-spacing:-.4em;'>}</span>}
<div class="paragraph"> </div>

</div>
    Success!  Conditions (a), (b) and (c) all hold now.  (To
    verify (c), we need to check that, under the assumption that <span class="inlinecode"><span class="id" type="var">X</span></span> <span class="inlinecode">≠</span>
    <span class="inlinecode">0</span>, we have <span class="inlinecode"><span class="id" type="var">Y</span></span> <span class="inlinecode">-</span> <span class="inlinecode"><span class="id" type="var">X</span></span> <span class="inlinecode">=</span> <span class="inlinecode">(<span class="id" type="var">Y</span></span> <span class="inlinecode">-</span> <span class="inlinecode">1)</span> <span class="inlinecode">-</span> <span class="inlinecode">(<span class="id" type="var">X</span></span> <span class="inlinecode">-</span> <span class="inlinecode">1)</span>; this holds for all
    natural numbers <span class="inlinecode"><span class="id" type="var">X</span></span> and <span class="inlinecode"><span class="id" type="var">Y</span></span>.) 
</div>

<div class="doc">
<a name="lab88"></a><h2 class="section">Exercise: Slow Assignment</h2>

<div class="paragraph"> </div>

<a name="lab89"></a><h4 class="section">Exercise: 2 stars, standard (slow_assignment)</h4>
 A roundabout way of assigning a number currently stored in <span class="inlinecode"><span class="id" type="var">X</span></span> to
    the variable <span class="inlinecode"><span class="id" type="var">Y</span></span> is to start <span class="inlinecode"><span class="id" type="var">Y</span></span> at <span class="inlinecode">0</span>, then decrement <span class="inlinecode"><span class="id" type="var">X</span></span> until
    it hits <span class="inlinecode">0</span>, incrementing <span class="inlinecode"><span class="id" type="var">Y</span></span> at each step. Here is a program that
    implements this idea:

<div class="paragraph"> </div>

<div class="code code-tight">
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{&nbsp;<span class="id" type="var">X</span>&nbsp;=&nbsp;<span class="id" type="var">m</span>&nbsp;<span style='letter-spacing:-.4em;'>}</span>}<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="var">Y</span>&nbsp;<span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>:</span>:</span>=</span>&nbsp;0;;<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="var">WHILE</span>&nbsp;~(<span class="id" type="var">X</span>&nbsp;=&nbsp;0)&nbsp;<span class="id" type="var">DO</span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="var">X</span>&nbsp;<span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>:</span>:</span>=</span>&nbsp;<span class="id" type="var">X</span>&nbsp;-&nbsp;1;;<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="var">Y</span>&nbsp;<span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>:</span>:</span>=</span>&nbsp;<span class="id" type="var">Y</span>&nbsp;+&nbsp;1<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="var">END</span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{&nbsp;<span class="id" type="var">Y</span>&nbsp;=&nbsp;<span class="id" type="var">m</span>&nbsp;<span style='letter-spacing:-.4em;'>}</span>}
<div class="paragraph"> </div>

</div>
    Write an informal decorated program showing that this procedure
    is correct. 
</div>
<div class="code code-tight">

<span class="comment">(*&nbsp;FILL&nbsp;IN&nbsp;HERE&nbsp;*)</span><br/><hr class='doublespaceincode'/>
<span class="comment">(*&nbsp;Do&nbsp;not&nbsp;modify&nbsp;the&nbsp;following&nbsp;line:&nbsp;*)</span><br/>
<span class="id" type="keyword">Definition</span> <span class="id" type="var">manual_grade_for_decorations_in_slow_assignment</span> : <span class="id" type="var">option</span> (<span class="id" type="var">nat</span>*<span class="id" type="var">string</span>) := <span class="id" type="var">None</span>.<br/>
</div>

<span class="proofbox">&#9744;</span> 

<div class="doc">
<a name="lab90"></a><h2 class="section">Exercise: Slow Addition</h2>

<div class="paragraph"> </div>

<a name="lab91"></a><h4 class="section">Exercise: 3 stars, standard, optional (add_slowly_decoration)</h4>
 The following program adds the variable X into the variable Z
    by repeatedly decrementing X and incrementing Z.

<div class="paragraph"> </div>

<div class="code code-tight">
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="var">WHILE</span>&nbsp;~(<span class="id" type="var">X</span>&nbsp;=&nbsp;0)&nbsp;<span class="id" type="var">DO</span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="var">Z</span>&nbsp;<span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>:</span>:</span>=</span>&nbsp;<span class="id" type="var">Z</span>&nbsp;+&nbsp;1;;<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="var">X</span>&nbsp;<span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>:</span>:</span>=</span>&nbsp;<span class="id" type="var">X</span>&nbsp;-&nbsp;1<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="var">END</span>
<div class="paragraph"> </div>

</div>
    Following the pattern of the <span class="inlinecode"><span class="id" type="var">subtract_slowly</span></span> example above, pick
    a precondition and postcondition that give an appropriate
    specification of <span class="inlinecode"><span class="id" type="var">add_slowly</span></span>; then (informally) decorate the
    program accordingly. 
</div>
<div class="code code-tight">

<span class="comment">(*&nbsp;FILL&nbsp;IN&nbsp;HERE&nbsp;*)</span><br/>
</div>

<span class="proofbox">&#9744;</span> 

<div class="doc">
<a name="lab92"></a><h2 class="section">Example: Parity</h2>

<div class="paragraph"> </div>

 Here is a cute little program for computing the parity of the
    value initially stored in <span class="inlinecode"><span class="id" type="var">X</span></span> (due to Daniel Cristofani).

<div class="paragraph"> </div>

<div class="code code-tight">
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{&nbsp;<span class="id" type="var">X</span>&nbsp;=&nbsp;<span class="id" type="var">m</span>&nbsp;<span style='letter-spacing:-.4em;'>}</span>}<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="var">WHILE</span>&nbsp;2&nbsp;≤&nbsp;<span class="id" type="var">X</span>&nbsp;<span class="id" type="var">DO</span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="var">X</span>&nbsp;<span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>:</span>:</span>=</span>&nbsp;<span class="id" type="var">X</span>&nbsp;-&nbsp;2<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="var">END</span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{&nbsp;<span class="id" type="var">X</span>&nbsp;=&nbsp;<span class="id" type="var">parity</span>&nbsp;<span class="id" type="var">m</span>&nbsp;<span style='letter-spacing:-.4em;'>}</span>}
<div class="paragraph"> </div>

</div>
    The mathematical <span class="inlinecode"><span class="id" type="var">parity</span></span> function used in the specification is
    defined in Coq as follows: 
</div>
<div class="code code-tight">

<span class="id" type="keyword">Fixpoint</span> <span class="id" type="var">parity</span> <span class="id" type="var">x</span> :=<br/>
&nbsp;&nbsp;<span class="id" type="keyword">match</span> <span class="id" type="var">x</span> <span class="id" type="keyword">with</span><br/>
&nbsp;&nbsp;| 0 ⇒ 0<br/>
&nbsp;&nbsp;| 1 ⇒ 1<br/>
&nbsp;&nbsp;| <span class="id" type="var">S</span> (<span class="id" type="var">S</span> <span class="id" type="var">x'</span>) ⇒ <span class="id" type="var">parity</span> <span class="id" type="var">x'</span><br/>
&nbsp;&nbsp;<span class="id" type="keyword">end</span>.<br/>
</div>

<div class="doc">
The postcondition does not hold at the beginning of the loop,
    since <span class="inlinecode"><span class="id" type="var">m</span></span> <span class="inlinecode">=</span> <span class="inlinecode"><span class="id" type="var">parity</span></span> <span class="inlinecode"><span class="id" type="var">m</span></span> does not hold for an arbitrary <span class="inlinecode"><span class="id" type="var">m</span></span>, so we
    cannot use that as an invariant.  To find an invariant that works,
    let's think a bit about what this loop does.  On each iteration it
    decrements <span class="inlinecode"><span class="id" type="var">X</span></span> by <span class="inlinecode">2</span>, which preserves the parity of <span class="inlinecode"><span class="id" type="var">X</span></span>.  So the
    parity of <span class="inlinecode"><span class="id" type="var">X</span></span> does not change, i.e., it is invariant.  The initial
    value of <span class="inlinecode"><span class="id" type="var">X</span></span> is <span class="inlinecode"><span class="id" type="var">m</span></span>, so the parity of <span class="inlinecode"><span class="id" type="var">X</span></span> is always equal to the
    parity of <span class="inlinecode"><span class="id" type="var">m</span></span>. Using <span class="inlinecode"><span class="id" type="var">parity</span></span> <span class="inlinecode"><span class="id" type="var">X</span></span> <span class="inlinecode">=</span> <span class="inlinecode"><span class="id" type="var">parity</span></span> <span class="inlinecode"><span class="id" type="var">m</span></span> as an invariant we
    obtain the following decorated program:

<div class="paragraph"> </div>

<div class="code code-tight">
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{&nbsp;<span class="id" type="var">X</span>&nbsp;=&nbsp;<span class="id" type="var">m</span>&nbsp;<span style='letter-spacing:-.4em;'>}</span>}&nbsp;<span class="nowrap"><span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>-</span></span><span style='letter-spacing:-.2em;'>></span>></span></span>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;(<span class="id" type="var">a</span>&nbsp;-&nbsp;<span class="id" type="var">OK</span>)<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{&nbsp;<span class="id" type="var">parity</span>&nbsp;<span class="id" type="var">X</span>&nbsp;=&nbsp;<span class="id" type="var">parity</span>&nbsp;<span class="id" type="var">m</span>&nbsp;<span style='letter-spacing:-.4em;'>}</span>}<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="var">WHILE</span>&nbsp;2&nbsp;≤&nbsp;<span class="id" type="var">X</span>&nbsp;<span class="id" type="var">DO</span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{&nbsp;<span class="id" type="var">parity</span>&nbsp;<span class="id" type="var">X</span>&nbsp;=&nbsp;<span class="id" type="var">parity</span>&nbsp;<span class="id" type="var">m</span>&nbsp;∧&nbsp;2&nbsp;≤&nbsp;<span class="id" type="var">X</span>&nbsp;<span style='letter-spacing:-.4em;'>}</span>}&nbsp;&nbsp;<span class="nowrap"><span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>-</span></span><span style='letter-spacing:-.2em;'>></span>></span></span>&nbsp;&nbsp;&nbsp;&nbsp;(<span class="id" type="var">c</span>&nbsp;-&nbsp;<span class="id" type="var">OK</span>)<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{&nbsp;<span class="id" type="var">parity</span>&nbsp;(<span class="id" type="var">X</span>-2)&nbsp;=&nbsp;<span class="id" type="var">parity</span>&nbsp;<span class="id" type="var">m</span>&nbsp;<span style='letter-spacing:-.4em;'>}</span>}<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="var">X</span>&nbsp;<span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>:</span>:</span>=</span>&nbsp;<span class="id" type="var">X</span>&nbsp;-&nbsp;2<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{&nbsp;<span class="id" type="var">parity</span>&nbsp;<span class="id" type="var">X</span>&nbsp;=&nbsp;<span class="id" type="var">parity</span>&nbsp;<span class="id" type="var">m</span>&nbsp;<span style='letter-spacing:-.4em;'>}</span>}<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="var">END</span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{&nbsp;<span class="id" type="var">parity</span>&nbsp;<span class="id" type="var">X</span>&nbsp;=&nbsp;<span class="id" type="var">parity</span>&nbsp;<span class="id" type="var">m</span>&nbsp;∧&nbsp;<span class="id" type="var">X</span>&nbsp;&lt;&nbsp;2&nbsp;<span style='letter-spacing:-.4em;'>}</span>}&nbsp;&nbsp;<span class="nowrap"><span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>-</span></span><span style='letter-spacing:-.2em;'>></span>></span></span>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;(<span class="id" type="var">b</span>&nbsp;-&nbsp;<span class="id" type="var">OK</span>)<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{&nbsp;<span class="id" type="var">X</span>&nbsp;=&nbsp;<span class="id" type="var">parity</span>&nbsp;<span class="id" type="var">m</span>&nbsp;<span style='letter-spacing:-.4em;'>}</span>}
<div class="paragraph"> </div>

</div>
    With this invariant, conditions (a), (b), and (c) are all
    satisfied. For verifying (b), we observe that, when <span class="inlinecode"><span class="id" type="var">X</span></span> <span class="inlinecode">&lt;</span> <span class="inlinecode">2</span>, we
    have <span class="inlinecode"><span class="id" type="var">parity</span></span> <span class="inlinecode"><span class="id" type="var">X</span></span> <span class="inlinecode">=</span> <span class="inlinecode"><span class="id" type="var">X</span></span> (we can easily see this in the definition of
    <span class="inlinecode"><span class="id" type="var">parity</span></span>).  For verifying (c), we observe that, when <span class="inlinecode">2</span> <span class="inlinecode">≤</span> <span class="inlinecode"><span class="id" type="var">X</span></span>, we
    have <span class="inlinecode"><span class="id" type="var">parity</span></span> <span class="inlinecode"><span class="id" type="var">X</span></span> <span class="inlinecode">=</span> <span class="inlinecode"><span class="id" type="var">parity</span></span> <span class="inlinecode">(<span class="id" type="var">X</span>-2)</span>. 
<div class="paragraph"> </div>

<a name="lab93"></a><h4 class="section">Exercise: 3 stars, standard, optional (parity_formal)</h4>
 Translate this proof to Coq. Refer to the <span class="inlinecode"><span class="id" type="var">reduce_to_zero</span></span> example
    for ideas. You may find the following two lemmas useful: 
</div>
<div class="code code-tight">

<span class="id" type="keyword">Lemma</span> <span class="id" type="var">parity_ge_2</span> : <span style='font-size:120%;'>&forall;</span><span class="id" type="var">x</span>,<br/>
&nbsp;&nbsp;2 ≤ <span class="id" type="var">x</span> →<br/>
&nbsp;&nbsp;<span class="id" type="var">parity</span> (<span class="id" type="var">x</span> - 2) = <span class="id" type="var">parity</span> <span class="id" type="var">x</span>.<br/>
<div class="togglescript" id="proofcontrol2" onclick="toggleDisplay('proof2');toggleDisplay('proofcontrol2')"><span class="show"></span></div>
<div class="proofscript" id="proof2" onclick="toggleDisplay('proof2');toggleDisplay('proofcontrol2')">
<span class="id" type="keyword">Proof</span>.<br/>
&nbsp;&nbsp;<span class="id" type="tactic">induction</span> <span class="id" type="var">x</span>; <span class="id" type="tactic">intro</span>. <span class="id" type="tactic">reflexivity</span>.<br/>
&nbsp;&nbsp;<span class="id" type="tactic">destruct</span> <span class="id" type="var">x</span>. <span class="id" type="tactic">inversion</span> <span class="id" type="var">H</span>. <span class="id" type="tactic">inversion</span> <span class="id" type="var">H<sub>1</sub></span>.<br/>
&nbsp;&nbsp;<span class="id" type="tactic">simpl</span>. <span class="id" type="tactic">rewrite</span> &lt;- <span class="id" type="var">minus_n_O</span>. <span class="id" type="tactic">reflexivity</span>.<br/>
<span class="id" type="keyword">Qed</span>.<br/>
</div>

<br/>
<span class="id" type="keyword">Lemma</span> <span class="id" type="var">parity_lt_2</span> : <span style='font-size:120%;'>&forall;</span><span class="id" type="var">x</span>,<br/>
&nbsp;&nbsp;¬2 ≤ <span class="id" type="var">x</span> →<br/>
&nbsp;&nbsp;<span class="id" type="var">parity</span> (<span class="id" type="var">x</span>) = <span class="id" type="var">x</span>.<br/>
<div class="togglescript" id="proofcontrol3" onclick="toggleDisplay('proof3');toggleDisplay('proofcontrol3')"><span class="show"></span></div>
<div class="proofscript" id="proof3" onclick="toggleDisplay('proof3');toggleDisplay('proofcontrol3')">
<span class="id" type="keyword">Proof</span>.<br/>
&nbsp;&nbsp;<span class="id" type="tactic">intros</span>. <span class="id" type="tactic">induction</span> <span class="id" type="var">x</span>. <span class="id" type="tactic">reflexivity</span>. <span class="id" type="tactic">destruct</span> <span class="id" type="var">x</span>. <span class="id" type="tactic">reflexivity</span>.<br/>
&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="var">exfalso</span>. <span class="id" type="tactic">apply</span> <span class="id" type="var">H</span>. <span class="id" type="tactic">omega</span>.<br/>
<span class="id" type="keyword">Qed</span>.<br/>
</div>

<br/>
<span class="id" type="keyword">Theorem</span> <span class="id" type="var">parity_correct</span> : <span style='font-size:120%;'>&forall;</span><span class="id" type="var">m</span>,<br/>
&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{ <span class="id" type="keyword">fun</span> <span class="id" type="var">st</span> ⇒ <span class="id" type="var">st</span> <span class="id" type="var">X</span> = <span class="id" type="var">m</span> <span style='letter-spacing:-.4em;'>}</span>}<br/>
&nbsp;&nbsp;<span class="id" type="var">WHILE</span> 2 ≤ <span class="id" type="var">X</span> <span class="id" type="var">DO</span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="var">X</span> <span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>:</span>:</span>=</span> <span class="id" type="var">X</span> - 2<br/>
&nbsp;&nbsp;<span class="id" type="var">END</span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{ <span class="id" type="keyword">fun</span> <span class="id" type="var">st</span> ⇒ <span class="id" type="var">st</span> <span class="id" type="var">X</span> = <span class="id" type="var">parity</span> <span class="id" type="var">m</span> <span style='letter-spacing:-.4em;'>}</span>}.<br/>
<span class="id" type="keyword">Proof</span>.<br/>
&nbsp;&nbsp;<span class="comment">(*&nbsp;FILL&nbsp;IN&nbsp;HERE&nbsp;*)</span> <span class="id" type="var">Admitted</span>.<br/>
</div>

<span class="proofbox">&#9744;</span> 

<div class="doc">
<a name="lab94"></a><h2 class="section">Example: Finding Square Roots</h2>

<div class="paragraph"> </div>

 The following program computes the (integer) square root of <span class="inlinecode"><span class="id" type="var">X</span></span>
    by naive iteration:

<div class="paragraph"> </div>

<div class="code code-tight">
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{&nbsp;<span class="id" type="var">X</span>=<span class="id" type="var">m</span>&nbsp;<span style='letter-spacing:-.4em;'>}</span>}<br/>
&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="var">Z</span>&nbsp;<span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>:</span>:</span>=</span>&nbsp;0;;<br/>
&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="var">WHILE</span>&nbsp;(<span class="id" type="var">Z</span>+1)*(<span class="id" type="var">Z</span>+1)&nbsp;≤&nbsp;<span class="id" type="var">X</span>&nbsp;<span class="id" type="var">DO</span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="var">Z</span>&nbsp;<span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>:</span>:</span>=</span>&nbsp;<span class="id" type="var">Z</span>+1<br/>
&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="var">END</span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{&nbsp;<span class="id" type="var">Z</span>*<span class="id" type="var">Z</span>≤<span class="id" type="var">m</span>&nbsp;∧&nbsp;<span class="id" type="var">m</span>&lt;(<span class="id" type="var">Z</span>+1)*(<span class="id" type="var">Z</span>+1)&nbsp;<span style='letter-spacing:-.4em;'>}</span>}
<div class="paragraph"> </div>

</div>

<div class="paragraph"> </div>

 As above, we can try to use the postcondition as a candidate
    invariant, obtaining the following decorated program:

<div class="paragraph"> </div>

<div class="code code-tight">
&nbsp;&nbsp;&nbsp;&nbsp;(1)&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{&nbsp;<span class="id" type="var">X</span>=<span class="id" type="var">m</span>&nbsp;<span style='letter-spacing:-.4em;'>}</span>}&nbsp;&nbsp;<span class="nowrap"><span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>-</span></span><span style='letter-spacing:-.2em;'>></span>></span></span>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;(<span class="id" type="var">a</span>&nbsp;-&nbsp;<span class="id" type="var">second</span>&nbsp;<span class="id" type="var">conjunct</span>&nbsp;<span class="id" type="var">of</span>&nbsp;(2)&nbsp;<span class="id" type="var">WRONG</span>!)<br/>
&nbsp;&nbsp;&nbsp;&nbsp;(2)&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{&nbsp;0*0&nbsp;≤&nbsp;<span class="id" type="var">m</span>&nbsp;∧&nbsp;<span class="id" type="var">m</span>&lt;1*1&nbsp;<span style='letter-spacing:-.4em;'>}</span>}<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="var">Z</span>&nbsp;<span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>:</span>:</span>=</span>&nbsp;0;;<br/>
&nbsp;&nbsp;&nbsp;&nbsp;(3)&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{&nbsp;<span class="id" type="var">Z</span>*<span class="id" type="var">Z</span>&nbsp;≤&nbsp;<span class="id" type="var">m</span>&nbsp;∧&nbsp;<span class="id" type="var">m</span>&lt;(<span class="id" type="var">Z</span>+1)*(<span class="id" type="var">Z</span>+1)&nbsp;<span style='letter-spacing:-.4em;'>}</span>}<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="var">WHILE</span>&nbsp;(<span class="id" type="var">Z</span>+1)*(<span class="id" type="var">Z</span>+1)&nbsp;≤&nbsp;<span class="id" type="var">X</span>&nbsp;<span class="id" type="var">DO</span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;(4)&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{&nbsp;<span class="id" type="var">Z</span>*<span class="id" type="var">Z</span>≤<span class="id" type="var">m</span>&nbsp;∧&nbsp;(<span class="id" type="var">Z</span>+1)*(<span class="id" type="var">Z</span>+1)≤<span class="id" type="var">X</span>&nbsp;<span style='letter-spacing:-.4em;'>}</span>}&nbsp;&nbsp;<span class="nowrap"><span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>-</span></span><span style='letter-spacing:-.2em;'>></span>></span></span>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;(<span class="id" type="var">c</span>&nbsp;-&nbsp;<span class="id" type="var">WRONG</span>!)<br/>
&nbsp;&nbsp;&nbsp;&nbsp;(5)&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{&nbsp;(<span class="id" type="var">Z</span>+1)*(<span class="id" type="var">Z</span>+1)≤<span class="id" type="var">m</span>&nbsp;∧&nbsp;<span class="id" type="var">m</span>&lt;(<span class="id" type="var">Z</span>+2)*(<span class="id" type="var">Z</span>+2)&nbsp;<span style='letter-spacing:-.4em;'>}</span>}<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="var">Z</span>&nbsp;<span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>:</span>:</span>=</span>&nbsp;<span class="id" type="var">Z</span>+1<br/>
&nbsp;&nbsp;&nbsp;&nbsp;(6)&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{&nbsp;<span class="id" type="var">Z</span>*<span class="id" type="var">Z</span>≤<span class="id" type="var">m</span>&nbsp;∧&nbsp;<span class="id" type="var">m</span>&lt;(<span class="id" type="var">Z</span>+1)*(<span class="id" type="var">Z</span>+1)&nbsp;<span style='letter-spacing:-.4em;'>}</span>}<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="var">END</span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;(7)&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{&nbsp;<span class="id" type="var">Z</span>*<span class="id" type="var">Z</span>≤<span class="id" type="var">m</span>&nbsp;∧&nbsp;<span class="id" type="var">m</span>&lt;(<span class="id" type="var">Z</span>+1)*(<span class="id" type="var">Z</span>+1)&nbsp;∧&nbsp;~((<span class="id" type="var">Z</span>+1)*(<span class="id" type="var">Z</span>+1)≤<span class="id" type="var">X</span>)&nbsp;<span style='letter-spacing:-.4em;'>}</span>}&nbsp;&nbsp;<span class="nowrap"><span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>-</span></span><span style='letter-spacing:-.2em;'>></span>></span></span>&nbsp;(<span class="id" type="var">b</span>&nbsp;-&nbsp;<span class="id" type="var">OK</span>)<br/>
&nbsp;&nbsp;&nbsp;&nbsp;(8)&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{&nbsp;<span class="id" type="var">Z</span>*<span class="id" type="var">Z</span>≤<span class="id" type="var">m</span>&nbsp;∧&nbsp;<span class="id" type="var">m</span>&lt;(<span class="id" type="var">Z</span>+1)*(<span class="id" type="var">Z</span>+1)&nbsp;<span style='letter-spacing:-.4em;'>}</span>}
<div class="paragraph"> </div>

</div>
    This didn't work very well: conditions (a) and (c) both failed.
    Looking at condition (c), we see that the second conjunct of (4)
    is almost the same as the first conjunct of (5), except that (4)
    mentions <span class="inlinecode"><span class="id" type="var">X</span></span> while (5) mentions <span class="inlinecode"><span class="id" type="var">m</span></span>. But note that <span class="inlinecode"><span class="id" type="var">X</span></span> is never
    assigned in this program, so we should always have <span class="inlinecode"><span class="id" type="var">X</span>=<span class="id" type="var">m</span></span>; we
    didn't propagate this information from (1) into the loop 
    invariant, but we could!

<div class="paragraph"> </div>

    Also, we don't need the second conjunct of (8), since we can 
    obtain it from the negation of the guard &mdash; the third conjunct 
    in (7) &mdash; again under the assumption that <span class="inlinecode"><span class="id" type="var">X</span>=<span class="id" type="var">m</span></span>.  This allows 
    us to simplify a bit.

<div class="paragraph"> </div>

    So we now try <span class="inlinecode"><span class="id" type="var">X</span>=<span class="id" type="var">m</span></span> <span class="inlinecode">∧</span> <span class="inlinecode"><span class="id" type="var">Z</span>*<span class="id" type="var">Z</span></span> <span class="inlinecode">≤</span> <span class="inlinecode"><span class="id" type="var">m</span></span> as the loop invariant:

<div class="paragraph"> </div>

<div class="code code-tight">
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{&nbsp;<span class="id" type="var">X</span>=<span class="id" type="var">m</span>&nbsp;<span style='letter-spacing:-.4em;'>}</span>}&nbsp;&nbsp;<span class="nowrap"><span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>-</span></span><span style='letter-spacing:-.2em;'>></span>></span></span>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;(<span class="id" type="var">a</span>&nbsp;-&nbsp;<span class="id" type="var">OK</span>)<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{&nbsp;<span class="id" type="var">X</span>=<span class="id" type="var">m</span>&nbsp;∧&nbsp;0*0&nbsp;≤&nbsp;<span class="id" type="var">m</span>&nbsp;<span style='letter-spacing:-.4em;'>}</span>}<br/>
&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="var">Z</span>&nbsp;<span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>:</span>:</span>=</span>&nbsp;0;<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{&nbsp;<span class="id" type="var">X</span>=<span class="id" type="var">m</span>&nbsp;∧&nbsp;<span class="id" type="var">Z</span>*<span class="id" type="var">Z</span>&nbsp;≤&nbsp;<span class="id" type="var">m</span>&nbsp;<span style='letter-spacing:-.4em;'>}</span>}<br/>
&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="var">WHILE</span>&nbsp;(<span class="id" type="var">Z</span>+1)*(<span class="id" type="var">Z</span>+1)&nbsp;≤&nbsp;<span class="id" type="var">X</span>&nbsp;<span class="id" type="var">DO</span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{&nbsp;<span class="id" type="var">X</span>=<span class="id" type="var">m</span>&nbsp;∧&nbsp;<span class="id" type="var">Z</span>*<span class="id" type="var">Z</span>≤<span class="id" type="var">m</span>&nbsp;∧&nbsp;(<span class="id" type="var">Z</span>+1)*(<span class="id" type="var">Z</span>+1)≤<span class="id" type="var">X</span>&nbsp;<span style='letter-spacing:-.4em;'>}</span>}&nbsp;&nbsp;<span class="nowrap"><span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>-</span></span><span style='letter-spacing:-.2em;'>></span>></span></span>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;(<span class="id" type="var">c</span>&nbsp;-&nbsp;<span class="id" type="var">OK</span>)<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{&nbsp;<span class="id" type="var">X</span>=<span class="id" type="var">m</span>&nbsp;∧&nbsp;(<span class="id" type="var">Z</span>+1)*(<span class="id" type="var">Z</span>+1)≤<span class="id" type="var">m</span>&nbsp;<span style='letter-spacing:-.4em;'>}</span>}<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="var">Z</span>&nbsp;<span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>:</span>:</span>=</span>&nbsp;<span class="id" type="var">Z</span>&nbsp;+&nbsp;1<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{&nbsp;<span class="id" type="var">X</span>=<span class="id" type="var">m</span>&nbsp;∧&nbsp;<span class="id" type="var">Z</span>*<span class="id" type="var">Z</span>≤<span class="id" type="var">m</span>&nbsp;<span style='letter-spacing:-.4em;'>}</span>}<br/>
&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="var">END</span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{&nbsp;<span class="id" type="var">X</span>=<span class="id" type="var">m</span>&nbsp;∧&nbsp;<span class="id" type="var">Z</span>*<span class="id" type="var">Z</span>≤<span class="id" type="var">m</span>&nbsp;∧&nbsp;<span class="id" type="var">X</span>&lt;(<span class="id" type="var">Z</span>+1)*(<span class="id" type="var">Z</span>+1)&nbsp;<span style='letter-spacing:-.4em;'>}</span>}&nbsp;&nbsp;<span class="nowrap"><span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>-</span></span><span style='letter-spacing:-.2em;'>></span>></span></span>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;(<span class="id" type="var">b</span>&nbsp;-&nbsp;<span class="id" type="var">OK</span>)<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{&nbsp;<span class="id" type="var">Z</span>*<span class="id" type="var">Z</span>≤<span class="id" type="var">m</span>&nbsp;∧&nbsp;<span class="id" type="var">m</span>&lt;(<span class="id" type="var">Z</span>+1)*(<span class="id" type="var">Z</span>+1)&nbsp;<span style='letter-spacing:-.4em;'>}</span>}
<div class="paragraph"> </div>

</div>
    This works, since conditions (a), (b), and (c) are now all
    trivially satisfied.

<div class="paragraph"> </div>

    Very often, if a variable is used in a loop in a read-only
    fashion (i.e., it is referred to by the program or by the
    specification and it is not changed by the loop), it is necessary
    to add the fact that it doesn't change to the loop invariant. 
</div>

<div class="doc">
<a name="lab95"></a><h2 class="section">Example: Squaring</h2>

<div class="paragraph"> </div>

 Here is a program that squares <span class="inlinecode"><span class="id" type="var">X</span></span> by repeated addition:

<div class="paragraph"> </div>

<div class="code code-tight">
&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{&nbsp;<span class="id" type="var">X</span>&nbsp;=&nbsp;<span class="id" type="var">m</span>&nbsp;<span style='letter-spacing:-.4em;'>}</span>}<br/>
&nbsp;&nbsp;<span class="id" type="var">Y</span>&nbsp;<span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>:</span>:</span>=</span>&nbsp;0;;<br/>
&nbsp;&nbsp;<span class="id" type="var">Z</span>&nbsp;<span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>:</span>:</span>=</span>&nbsp;0;;<br/>
&nbsp;&nbsp;<span class="id" type="var">WHILE</span>&nbsp;~(<span class="id" type="var">Y</span>&nbsp;=&nbsp;<span class="id" type="var">X</span>)&nbsp;&nbsp;<span class="id" type="var">DO</span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="var">Z</span>&nbsp;<span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>:</span>:</span>=</span>&nbsp;<span class="id" type="var">Z</span>&nbsp;+&nbsp;<span class="id" type="var">X</span>;;<br/>
&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="var">Y</span>&nbsp;<span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>:</span>:</span>=</span>&nbsp;<span class="id" type="var">Y</span>&nbsp;+&nbsp;1<br/>
&nbsp;&nbsp;<span class="id" type="var">END</span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{&nbsp;<span class="id" type="var">Z</span>&nbsp;=&nbsp;<span class="id" type="var">m</span>*<span class="id" type="var">m</span>&nbsp;<span style='letter-spacing:-.4em;'>}</span>}
<div class="paragraph"> </div>

</div>

<div class="paragraph"> </div>

 The first thing to note is that the loop reads <span class="inlinecode"><span class="id" type="var">X</span></span> but doesn't
    change its value. As we saw in the previous example, it is a good idea
    in such cases to add <span class="inlinecode"><span class="id" type="var">X</span></span> <span class="inlinecode">=</span> <span class="inlinecode"><span class="id" type="var">m</span></span> to the invariant.  The other thing
    that we know is often useful in the invariant is the postcondition,
    so let's add that too, leading to the invariant candidate
    <span class="inlinecode"><span class="id" type="var">Z</span></span> <span class="inlinecode">=</span> <span class="inlinecode"><span class="id" type="var">m</span></span> <span class="inlinecode">*</span> <span class="inlinecode"><span class="id" type="var">m</span></span> <span class="inlinecode">∧</span> <span class="inlinecode"><span class="id" type="var">X</span></span> <span class="inlinecode">=</span> <span class="inlinecode"><span class="id" type="var">m</span></span>.

<div class="paragraph"> </div>

<div class="code code-tight">
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{&nbsp;<span class="id" type="var">X</span>&nbsp;=&nbsp;<span class="id" type="var">m</span>&nbsp;<span style='letter-spacing:-.4em;'>}</span>}&nbsp;<span class="nowrap"><span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>-</span></span><span style='letter-spacing:-.2em;'>></span>></span></span>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;(<span class="id" type="var">a</span>&nbsp;-&nbsp;<span class="id" type="var">WRONG</span>)<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{&nbsp;0&nbsp;=&nbsp;<span class="id" type="var">m</span>*<span class="id" type="var">m</span>&nbsp;∧&nbsp;<span class="id" type="var">X</span>&nbsp;=&nbsp;<span class="id" type="var">m</span>&nbsp;<span style='letter-spacing:-.4em;'>}</span>}<br/>
&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="var">Y</span>&nbsp;<span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>:</span>:</span>=</span>&nbsp;0;;<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{&nbsp;0&nbsp;=&nbsp;<span class="id" type="var">m</span>*<span class="id" type="var">m</span>&nbsp;∧&nbsp;<span class="id" type="var">X</span>&nbsp;=&nbsp;<span class="id" type="var">m</span>&nbsp;<span style='letter-spacing:-.4em;'>}</span>}<br/>
&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="var">Z</span>&nbsp;<span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>:</span>:</span>=</span>&nbsp;0;;<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{&nbsp;<span class="id" type="var">Z</span>&nbsp;=&nbsp;<span class="id" type="var">m</span>*<span class="id" type="var">m</span>&nbsp;∧&nbsp;<span class="id" type="var">X</span>&nbsp;=&nbsp;<span class="id" type="var">m</span>&nbsp;<span style='letter-spacing:-.4em;'>}</span>}<br/>
&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="var">WHILE</span>&nbsp;~(<span class="id" type="var">Y</span>&nbsp;=&nbsp;<span class="id" type="var">X</span>)&nbsp;<span class="id" type="var">DO</span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{&nbsp;<span class="id" type="var">Z</span>&nbsp;=&nbsp;<span class="id" type="var">Y</span>*<span class="id" type="var">m</span>&nbsp;∧&nbsp;<span class="id" type="var">X</span>&nbsp;=&nbsp;<span class="id" type="var">m</span>&nbsp;∧&nbsp;<span class="id" type="var">Y</span>&nbsp;≠&nbsp;<span class="id" type="var">X</span>&nbsp;<span style='letter-spacing:-.4em;'>}</span>}&nbsp;<span class="nowrap"><span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>-</span></span><span style='letter-spacing:-.2em;'>></span>></span></span>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;(<span class="id" type="var">c</span>&nbsp;-&nbsp;<span class="id" type="var">WRONG</span>)<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{&nbsp;<span class="id" type="var">Z</span>+<span class="id" type="var">X</span>&nbsp;=&nbsp;<span class="id" type="var">m</span>*<span class="id" type="var">m</span>&nbsp;∧&nbsp;<span class="id" type="var">X</span>&nbsp;=&nbsp;<span class="id" type="var">m</span>&nbsp;<span style='letter-spacing:-.4em;'>}</span>}<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="var">Z</span>&nbsp;<span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>:</span>:</span>=</span>&nbsp;<span class="id" type="var">Z</span>&nbsp;+&nbsp;<span class="id" type="var">X</span>;;<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{&nbsp;<span class="id" type="var">Z</span>&nbsp;=&nbsp;<span class="id" type="var">m</span>*<span class="id" type="var">m</span>&nbsp;∧&nbsp;<span class="id" type="var">X</span>&nbsp;=&nbsp;<span class="id" type="var">m</span>&nbsp;<span style='letter-spacing:-.4em;'>}</span>}<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="var">Y</span>&nbsp;<span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>:</span>:</span>=</span>&nbsp;<span class="id" type="var">Y</span>&nbsp;+&nbsp;1<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{&nbsp;<span class="id" type="var">Z</span>&nbsp;=&nbsp;<span class="id" type="var">m</span>*<span class="id" type="var">m</span>&nbsp;∧&nbsp;<span class="id" type="var">X</span>&nbsp;=&nbsp;<span class="id" type="var">m</span>&nbsp;<span style='letter-spacing:-.4em;'>}</span>}<br/>
&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="var">END</span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{&nbsp;<span class="id" type="var">Z</span>&nbsp;=&nbsp;<span class="id" type="var">m</span>*<span class="id" type="var">m</span>&nbsp;∧&nbsp;<span class="id" type="var">X</span>&nbsp;=&nbsp;<span class="id" type="var">m</span>&nbsp;∧&nbsp;~(<span class="id" type="var">Y</span>&nbsp;≠&nbsp;<span class="id" type="var">X</span>)&nbsp;<span style='letter-spacing:-.4em;'>}</span>}&nbsp;<span class="nowrap"><span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>-</span></span><span style='letter-spacing:-.2em;'>></span>></span></span>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;(<span class="id" type="var">b</span>&nbsp;-&nbsp;<span class="id" type="var">OK</span>)<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{&nbsp;<span class="id" type="var">Z</span>&nbsp;=&nbsp;<span class="id" type="var">m</span>*<span class="id" type="var">m</span>&nbsp;<span style='letter-spacing:-.4em;'>}</span>}
<div class="paragraph"> </div>

</div>

<div class="paragraph"> </div>

    Conditions (a) and (c) fail because of the <span class="inlinecode"><span class="id" type="var">Z</span></span> <span class="inlinecode">=</span> <span class="inlinecode"><span class="id" type="var">m</span>*<span class="id" type="var">m</span></span> part.  While
    <span class="inlinecode"><span class="id" type="var">Z</span></span> starts at <span class="inlinecode">0</span> and works itself up to <span class="inlinecode"><span class="id" type="var">m</span>*<span class="id" type="var">m</span></span>, we can't expect
    <span class="inlinecode"><span class="id" type="var">Z</span></span> to be <span class="inlinecode"><span class="id" type="var">m</span>*<span class="id" type="var">m</span></span> from the start.  If we look at how <span class="inlinecode"><span class="id" type="var">Z</span></span> progresses
    in the loop, after the 1st iteration <span class="inlinecode"><span class="id" type="var">Z</span></span> <span class="inlinecode">=</span> <span class="inlinecode"><span class="id" type="var">m</span></span>, after the 2nd
    iteration <span class="inlinecode"><span class="id" type="var">Z</span></span> <span class="inlinecode">=</span> <span class="inlinecode">2*<span class="id" type="var">m</span></span>, and at the end <span class="inlinecode"><span class="id" type="var">Z</span></span> <span class="inlinecode">=</span> <span class="inlinecode"><span class="id" type="var">m</span>*<span class="id" type="var">m</span></span>.  Since the variable
    <span class="inlinecode"><span class="id" type="var">Y</span></span> tracks how many times we go through the loop, this leads us to
    derive a new invariant candidate: <span class="inlinecode"><span class="id" type="var">Z</span></span> <span class="inlinecode">=</span> <span class="inlinecode"><span class="id" type="var">Y</span>*<span class="id" type="var">m</span></span> <span class="inlinecode">∧</span> <span class="inlinecode"><span class="id" type="var">X</span></span> <span class="inlinecode">=</span> <span class="inlinecode"><span class="id" type="var">m</span></span>.

<div class="paragraph"> </div>

<div class="code code-tight">
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{&nbsp;<span class="id" type="var">X</span>&nbsp;=&nbsp;<span class="id" type="var">m</span>&nbsp;<span style='letter-spacing:-.4em;'>}</span>}&nbsp;<span class="nowrap"><span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>-</span></span><span style='letter-spacing:-.2em;'>></span>></span></span>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;(<span class="id" type="var">a</span>&nbsp;-&nbsp;<span class="id" type="var">OK</span>)<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{&nbsp;0&nbsp;=&nbsp;0*<span class="id" type="var">m</span>&nbsp;∧&nbsp;<span class="id" type="var">X</span>&nbsp;=&nbsp;<span class="id" type="var">m</span>&nbsp;<span style='letter-spacing:-.4em;'>}</span>}<br/>
&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="var">Y</span>&nbsp;<span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>:</span>:</span>=</span>&nbsp;0;;<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{&nbsp;0&nbsp;=&nbsp;<span class="id" type="var">Y</span>*<span class="id" type="var">m</span>&nbsp;∧&nbsp;<span class="id" type="var">X</span>&nbsp;=&nbsp;<span class="id" type="var">m</span>&nbsp;<span style='letter-spacing:-.4em;'>}</span>}<br/>
&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="var">Z</span>&nbsp;<span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>:</span>:</span>=</span>&nbsp;0;;<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{&nbsp;<span class="id" type="var">Z</span>&nbsp;=&nbsp;<span class="id" type="var">Y</span>*<span class="id" type="var">m</span>&nbsp;∧&nbsp;<span class="id" type="var">X</span>&nbsp;=&nbsp;<span class="id" type="var">m</span>&nbsp;<span style='letter-spacing:-.4em;'>}</span>}<br/>
&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="var">WHILE</span>&nbsp;~(<span class="id" type="var">Y</span>&nbsp;=&nbsp;<span class="id" type="var">X</span>)&nbsp;<span class="id" type="var">DO</span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{&nbsp;<span class="id" type="var">Z</span>&nbsp;=&nbsp;<span class="id" type="var">Y</span>*<span class="id" type="var">m</span>&nbsp;∧&nbsp;<span class="id" type="var">X</span>&nbsp;=&nbsp;<span class="id" type="var">m</span>&nbsp;∧&nbsp;<span class="id" type="var">Y</span>&nbsp;≠&nbsp;<span class="id" type="var">X</span>&nbsp;<span style='letter-spacing:-.4em;'>}</span>}&nbsp;<span class="nowrap"><span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>-</span></span><span style='letter-spacing:-.2em;'>></span>></span></span>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;(<span class="id" type="var">c</span>&nbsp;-&nbsp;<span class="id" type="var">OK</span>)<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{&nbsp;<span class="id" type="var">Z</span>+<span class="id" type="var">X</span>&nbsp;=&nbsp;(<span class="id" type="var">Y</span>+1)*<span class="id" type="var">m</span>&nbsp;∧&nbsp;<span class="id" type="var">X</span>&nbsp;=&nbsp;<span class="id" type="var">m</span>&nbsp;<span style='letter-spacing:-.4em;'>}</span>}<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="var">Z</span>&nbsp;<span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>:</span>:</span>=</span>&nbsp;<span class="id" type="var">Z</span>&nbsp;+&nbsp;<span class="id" type="var">X</span>;<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{&nbsp;<span class="id" type="var">Z</span>&nbsp;=&nbsp;(<span class="id" type="var">Y</span>+1)*<span class="id" type="var">m</span>&nbsp;∧&nbsp;<span class="id" type="var">X</span>&nbsp;=&nbsp;<span class="id" type="var">m</span>&nbsp;<span style='letter-spacing:-.4em;'>}</span>}<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="var">Y</span>&nbsp;<span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>:</span>:</span>=</span>&nbsp;<span class="id" type="var">Y</span>&nbsp;+&nbsp;1<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{&nbsp;<span class="id" type="var">Z</span>&nbsp;=&nbsp;<span class="id" type="var">Y</span>*<span class="id" type="var">m</span>&nbsp;∧&nbsp;<span class="id" type="var">X</span>&nbsp;=&nbsp;<span class="id" type="var">m</span>&nbsp;<span style='letter-spacing:-.4em;'>}</span>}<br/>
&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="var">END</span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{&nbsp;<span class="id" type="var">Z</span>&nbsp;=&nbsp;<span class="id" type="var">Y</span>*<span class="id" type="var">m</span>&nbsp;∧&nbsp;<span class="id" type="var">X</span>&nbsp;=&nbsp;<span class="id" type="var">m</span>&nbsp;∧&nbsp;~(<span class="id" type="var">Y</span>&nbsp;≠&nbsp;<span class="id" type="var">X</span>)&nbsp;<span style='letter-spacing:-.4em;'>}</span>}&nbsp;<span class="nowrap"><span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>-</span></span><span style='letter-spacing:-.2em;'>></span>></span></span>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;(<span class="id" type="var">b</span>&nbsp;-&nbsp;<span class="id" type="var">OK</span>)<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{&nbsp;<span class="id" type="var">Z</span>&nbsp;=&nbsp;<span class="id" type="var">m</span>*<span class="id" type="var">m</span>&nbsp;<span style='letter-spacing:-.4em;'>}</span>}
<div class="paragraph"> </div>

</div>

<div class="paragraph"> </div>

    This new invariant makes the proof go through: all three
    conditions are easy to check.

<div class="paragraph"> </div>

    It is worth comparing the postcondition <span class="inlinecode"><span class="id" type="var">Z</span></span> <span class="inlinecode">=</span> <span class="inlinecode"><span class="id" type="var">m</span>*<span class="id" type="var">m</span></span> and the <span class="inlinecode"><span class="id" type="var">Z</span></span> <span class="inlinecode">=</span>
    <span class="inlinecode"><span class="id" type="var">Y</span>*<span class="id" type="var">m</span></span> conjunct of the invariant. It is often the case that one has
    to replace parameters with variables &mdash; or with expressions 
    involving both variables and parameters, like <span class="inlinecode"><span class="id" type="var">m</span></span> <span class="inlinecode">-</span> <span class="inlinecode"><span class="id" type="var">Y</span></span> &mdash; when 
    going from postconditions to invariants. 
</div>

<div class="doc">
<a name="lab96"></a><h2 class="section">Exercise: Factorial</h2>

<div class="paragraph"> </div>

<a name="lab97"></a><h4 class="section">Exercise: 3 stars, standard (factorial)</h4>
 Recall that <span class="inlinecode"><span class="id" type="var">n</span>!</span> denotes the factorial of <span class="inlinecode"><span class="id" type="var">n</span></span> (i.e., <span class="inlinecode"><span class="id" type="var">n</span>!</span> <span class="inlinecode">=</span>
    <span class="inlinecode">1*2*...*<span class="id" type="var">n</span></span>).  Here is an Imp program that calculates the factorial
    of the number initially stored in the variable <span class="inlinecode"><span class="id" type="var">X</span></span> and puts it in
    the variable <span class="inlinecode"><span class="id" type="var">Y</span></span>:

<div class="paragraph"> </div>

<div class="code code-tight">
&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{&nbsp;<span class="id" type="var">X</span>&nbsp;=&nbsp;<span class="id" type="var">m</span>&nbsp;<span style='letter-spacing:-.4em;'>}</span>}<br/>
&nbsp;&nbsp;<span class="id" type="var">Y</span>&nbsp;<span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>:</span>:</span>=</span>&nbsp;1&nbsp;;;<br/>
&nbsp;&nbsp;<span class="id" type="var">WHILE</span>&nbsp;~(<span class="id" type="var">X</span>&nbsp;=&nbsp;0)<br/>
&nbsp;&nbsp;<span class="id" type="var">DO</span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="var">Y</span>&nbsp;<span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>:</span>:</span>=</span>&nbsp;<span class="id" type="var">Y</span>&nbsp;*&nbsp;<span class="id" type="var">X</span>&nbsp;;;<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="var">X</span>&nbsp;<span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>:</span>:</span>=</span>&nbsp;<span class="id" type="var">X</span>&nbsp;-&nbsp;1<br/>
&nbsp;&nbsp;<span class="id" type="var">END</span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{&nbsp;<span class="id" type="var">Y</span>&nbsp;=&nbsp;<span class="id" type="var">m</span>!&nbsp;<span style='letter-spacing:-.4em;'>}</span>}
<div class="paragraph"> </div>

</div>
    Fill in the blanks in following decorated program. For full credit,
    make sure all the arithmetic operations used in the assertions are
    well-defined on natural numbers.

<div class="paragraph"> </div>

<div class="code code-tight">
&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{&nbsp;<span class="id" type="var">X</span>&nbsp;=&nbsp;<span class="id" type="var">m</span>&nbsp;<span style='letter-spacing:-.4em;'>}</span>}&nbsp;<span class="nowrap"><span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>-</span></span><span style='letter-spacing:-.2em;'>></span>></span></span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>}</span>}<br/>
&nbsp;&nbsp;<span class="id" type="var">Y</span>&nbsp;<span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>:</span>:</span>=</span>&nbsp;1;;<br/>
&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>}</span>}<br/>
&nbsp;&nbsp;<span class="id" type="var">WHILE</span>&nbsp;~(<span class="id" type="var">X</span>&nbsp;=&nbsp;0)<br/>
&nbsp;&nbsp;<span class="id" type="var">DO</span>&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>}</span>}&nbsp;<span class="nowrap"><span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>-</span></span><span style='letter-spacing:-.2em;'>></span>></span></span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>}</span>}<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="var">Y</span>&nbsp;<span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>:</span>:</span>=</span>&nbsp;<span class="id" type="var">Y</span>&nbsp;*&nbsp;<span class="id" type="var">X</span>;;<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>}</span>}<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="var">X</span>&nbsp;<span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>:</span>:</span>=</span>&nbsp;<span class="id" type="var">X</span>&nbsp;-&nbsp;1<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>}</span>}<br/>
&nbsp;&nbsp;<span class="id" type="var">END</span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>}</span>}&nbsp;<span class="nowrap"><span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>-</span></span><span style='letter-spacing:-.2em;'>></span>></span></span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{&nbsp;<span class="id" type="var">Y</span>&nbsp;=&nbsp;<span class="id" type="var">m</span>!&nbsp;<span style='letter-spacing:-.4em;'>}</span>}
<div class="paragraph"> </div>

</div>

</div>
<div class="code code-tight">

<span class="comment">(*&nbsp;Do&nbsp;not&nbsp;modify&nbsp;the&nbsp;following&nbsp;line:&nbsp;*)</span><br/>
<span class="id" type="keyword">Definition</span> <span class="id" type="var">manual_grade_for_decorations_in_factorial</span> : <span class="id" type="var">option</span> (<span class="id" type="var">nat</span>*<span class="id" type="var">string</span>) := <span class="id" type="var">None</span>.<br/>
</div>

<span class="proofbox">&#9744;</span> 
<div class="code code-tight">

<span class="comment">(*&nbsp;LY:&nbsp;I&nbsp;saw&nbsp;one&nbsp;submission&nbsp;for&nbsp;<span class="inlinecode"><span class="id" type="var">factorial_dec</span></span>&nbsp;use&nbsp;a&nbsp;program&nbsp;like&nbsp;that&nbsp;instead<br/>
&nbsp;&nbsp;&nbsp;of&nbsp;the&nbsp;one&nbsp;already&nbsp;given&nbsp;by&nbsp;the&nbsp;informal&nbsp;exercise.&nbsp;I&nbsp;accepted&nbsp;it&nbsp;because&nbsp;the<br/>
&nbsp;&nbsp;&nbsp;exercise&nbsp;does&nbsp;not&nbsp;require&nbsp;to&nbsp;reuse&nbsp;the&nbsp;given&nbsp;program,&nbsp;and&nbsp;we&nbsp;did&nbsp;not<br/>
&nbsp;&nbsp;&nbsp;strictly&nbsp;define&nbsp;what&nbsp;it&nbsp;means&nbsp;to&nbsp;"implement"&nbsp;factorial&nbsp;in&nbsp;Imp.<br/>
&nbsp;&nbsp;&nbsp;This&nbsp;other&nbsp;one&nbsp;"implements"&nbsp;factorial&nbsp;in&nbsp;the&nbsp;same&nbsp;way&nbsp;two_loops_dec<br/>
&nbsp;&nbsp;&nbsp;"implements"&nbsp;the&nbsp;sum&nbsp;(a&nbsp;+&nbsp;b&nbsp;+&nbsp;c).<br/>
*)</span><br/>
</div>

<div class="doc">
<a name="lab98"></a><h2 class="section">Exercise: Min</h2>

<div class="paragraph"> </div>

<a name="lab99"></a><h4 class="section">Exercise: 3 stars, standard (Min_Hoare)</h4>
 Fill in valid decorations for the following program.
  For the <span class="inlinecode">⇒</span> steps in your annotations, you may rely (silently)
  on the following facts about min

<div class="paragraph"> </div>

<div class="code code-tight">
&nbsp;&nbsp;<span class="id" type="keyword">Lemma</span>&nbsp;<span class="id" type="var">lemma1</span>&nbsp;:&nbsp;<span style='font-size:120%;'>&forall;</span><span class="id" type="var">x</span>&nbsp;<span class="id" type="var">y</span>,<br/>
&nbsp;&nbsp;&nbsp;&nbsp;(<span class="id" type="var">x</span>=0&nbsp;∨&nbsp;<span class="id" type="var">y</span>=0)&nbsp;→&nbsp;<span class="id" type="var">min</span>&nbsp;<span class="id" type="var">x</span>&nbsp;<span class="id" type="var">y</span>&nbsp;=&nbsp;0.<br/>
&nbsp;&nbsp;<span class="id" type="keyword">Lemma</span>&nbsp;<span class="id" type="var">lemma2</span>&nbsp;:&nbsp;<span style='font-size:120%;'>&forall;</span><span class="id" type="var">x</span>&nbsp;<span class="id" type="var">y</span>,<br/>
&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="var">min</span>&nbsp;(<span class="id" type="var">x</span>-1)&nbsp;(<span class="id" type="var">y</span>-1)&nbsp;=&nbsp;(<span class="id" type="var">min</span>&nbsp;<span class="id" type="var">x</span>&nbsp;<span class="id" type="var">y</span>)&nbsp;-&nbsp;1.
<div class="paragraph"> </div>

</div>
  plus standard high-school algebra, as always.

<div class="paragraph"> </div>

<div class="code code-tight">
&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{&nbsp;<span class="id" type="var">True</span>&nbsp;<span style='letter-spacing:-.4em;'>}</span>}&nbsp;<span class="nowrap"><span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>-</span></span><span style='letter-spacing:-.2em;'>></span>></span></span><br/>
&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>}</span>}<br/>
&nbsp;&nbsp;<span class="id" type="var">X</span>&nbsp;<span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>:</span>:</span>=</span>&nbsp;<span class="id" type="var">a</span>;;<br/>
&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>}</span>}<br/>
&nbsp;&nbsp;<span class="id" type="var">Y</span>&nbsp;<span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>:</span>:</span>=</span>&nbsp;<span class="id" type="var">b</span>;;<br/>
&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>}</span>}<br/>
&nbsp;&nbsp;<span class="id" type="var">Z</span>&nbsp;<span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>:</span>:</span>=</span>&nbsp;0;;<br/>
&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>}</span>}<br/>
&nbsp;&nbsp;<span class="id" type="var">WHILE</span>&nbsp;~(<span class="id" type="var">X</span>&nbsp;=&nbsp;0)&nbsp;&amp;&amp;&nbsp;~(<span class="id" type="var">Y</span>&nbsp;=&nbsp;0)&nbsp;<span class="id" type="var">DO</span><br/>
&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>}</span>}&nbsp;<span class="nowrap"><span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>-</span></span><span style='letter-spacing:-.2em;'>></span>></span></span><br/>
&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>}</span>}<br/>
&nbsp;&nbsp;<span class="id" type="var">X</span>&nbsp;:=&nbsp;<span class="id" type="var">X</span>&nbsp;-&nbsp;1;;<br/>
&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>}</span>}<br/>
&nbsp;&nbsp;<span class="id" type="var">Y</span>&nbsp;:=&nbsp;<span class="id" type="var">Y</span>&nbsp;-&nbsp;1;;<br/>
&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>}</span>}<br/>
&nbsp;&nbsp;<span class="id" type="var">Z</span>&nbsp;:=&nbsp;<span class="id" type="var">Z</span>&nbsp;+&nbsp;1<br/>
&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>}</span>}<br/>
&nbsp;&nbsp;<span class="id" type="var">END</span><br/>
&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>}</span>}&nbsp;<span class="nowrap"><span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>-</span></span><span style='letter-spacing:-.2em;'>></span>></span></span><br/>
&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{&nbsp;<span class="id" type="var">Z</span>&nbsp;=&nbsp;<span class="id" type="var">min</span>&nbsp;<span class="id" type="var">a</span>&nbsp;<span class="id" type="var">b</span>&nbsp;<span style='letter-spacing:-.4em;'>}</span>}
<div class="paragraph"> </div>

</div>

</div>
<div class="code code-tight">

<span class="comment">(*&nbsp;Do&nbsp;not&nbsp;modify&nbsp;the&nbsp;following&nbsp;line:&nbsp;*)</span><br/>
<span class="id" type="keyword">Definition</span> <span class="id" type="var">manual_grade_for_decorations_in_Min_Hoare</span> : <span class="id" type="var">option</span> (<span class="id" type="var">nat</span>*<span class="id" type="var">string</span>) := <span class="id" type="var">None</span>.<br/>
</div>

<span class="proofbox">&#9744;</span> 
<div class="doc less-space">
<div class="paragraph"> </div>

<a name="lab100"></a><h4 class="section">Exercise: 3 stars, standard (two_loops)</h4>
 Here is a very inefficient way of adding 3 numbers:

<div class="paragraph"> </div>

<div class="code code-tight">
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="var">X</span>&nbsp;<span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>:</span>:</span>=</span>&nbsp;0;;<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="var">Y</span>&nbsp;<span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>:</span>:</span>=</span>&nbsp;0;;<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="var">Z</span>&nbsp;<span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>:</span>:</span>=</span>&nbsp;<span class="id" type="var">c</span>;;<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="var">WHILE</span>&nbsp;~(<span class="id" type="var">X</span>&nbsp;=&nbsp;<span class="id" type="var">a</span>)&nbsp;<span class="id" type="var">DO</span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="var">X</span>&nbsp;<span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>:</span>:</span>=</span>&nbsp;<span class="id" type="var">X</span>&nbsp;+&nbsp;1;;<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="var">Z</span>&nbsp;<span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>:</span>:</span>=</span>&nbsp;<span class="id" type="var">Z</span>&nbsp;+&nbsp;1<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="var">END</span>;;<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="var">WHILE</span>&nbsp;~(<span class="id" type="var">Y</span>&nbsp;=&nbsp;<span class="id" type="var">b</span>)&nbsp;<span class="id" type="var">DO</span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="var">Y</span>&nbsp;<span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>:</span>:</span>=</span>&nbsp;<span class="id" type="var">Y</span>&nbsp;+&nbsp;1;;<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="var">Z</span>&nbsp;<span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>:</span>:</span>=</span>&nbsp;<span class="id" type="var">Z</span>&nbsp;+&nbsp;1<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="var">END</span>
<div class="paragraph"> </div>

</div>
    Show that it does what it should by filling in the blanks in the
    following decorated program.

<div class="paragraph"> </div>

<div class="code code-tight">
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{&nbsp;<span class="id" type="var">True</span>&nbsp;<span style='letter-spacing:-.4em;'>}</span>}&nbsp;<span class="nowrap"><span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>-</span></span><span style='letter-spacing:-.2em;'>></span>></span></span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>}</span>}<br/>
&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="var">X</span>&nbsp;<span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>:</span>:</span>=</span>&nbsp;0;;<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>}</span>}<br/>
&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="var">Y</span>&nbsp;<span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>:</span>:</span>=</span>&nbsp;0;;<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>}</span>}<br/>
&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="var">Z</span>&nbsp;<span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>:</span>:</span>=</span>&nbsp;<span class="id" type="var">c</span>;;<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>}</span>}<br/>
&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="var">WHILE</span>&nbsp;~(<span class="id" type="var">X</span>&nbsp;=&nbsp;<span class="id" type="var">a</span>)&nbsp;<span class="id" type="var">DO</span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>}</span>}&nbsp;<span class="nowrap"><span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>-</span></span><span style='letter-spacing:-.2em;'>></span>></span></span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>}</span>}<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="var">X</span>&nbsp;<span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>:</span>:</span>=</span>&nbsp;<span class="id" type="var">X</span>&nbsp;+&nbsp;1;;<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>}</span>}<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="var">Z</span>&nbsp;<span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>:</span>:</span>=</span>&nbsp;<span class="id" type="var">Z</span>&nbsp;+&nbsp;1<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>}</span>}<br/>
&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="var">END</span>;;<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>}</span>}&nbsp;<span class="nowrap"><span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>-</span></span><span style='letter-spacing:-.2em;'>></span>></span></span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>}</span>}<br/>
&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="var">WHILE</span>&nbsp;~(<span class="id" type="var">Y</span>&nbsp;=&nbsp;<span class="id" type="var">b</span>)&nbsp;<span class="id" type="var">DO</span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>}</span>}&nbsp;<span class="nowrap"><span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>-</span></span><span style='letter-spacing:-.2em;'>></span>></span></span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>}</span>}<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="var">Y</span>&nbsp;<span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>:</span>:</span>=</span>&nbsp;<span class="id" type="var">Y</span>&nbsp;+&nbsp;1;;<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>}</span>}<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="var">Z</span>&nbsp;<span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>:</span>:</span>=</span>&nbsp;<span class="id" type="var">Z</span>&nbsp;+&nbsp;1<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>}</span>}<br/>
&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="var">END</span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>}</span>}&nbsp;<span class="nowrap"><span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>-</span></span><span style='letter-spacing:-.2em;'>></span>></span></span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{&nbsp;<span class="id" type="var">Z</span>&nbsp;=&nbsp;<span class="id" type="var">a</span>&nbsp;+&nbsp;<span class="id" type="var">b</span>&nbsp;+&nbsp;<span class="id" type="var">c</span>&nbsp;<span style='letter-spacing:-.4em;'>}</span>}
<div class="paragraph"> </div>

</div>

</div>
<div class="code code-tight">

<span class="comment">(*&nbsp;Do&nbsp;not&nbsp;modify&nbsp;the&nbsp;following&nbsp;line:&nbsp;*)</span><br/>
<span class="id" type="keyword">Definition</span> <span class="id" type="var">manual_grade_for_decorations_in_two_loops</span> : <span class="id" type="var">option</span> (<span class="id" type="var">nat</span>*<span class="id" type="var">string</span>) := <span class="id" type="var">None</span>.<br/>
</div>

<span class="proofbox">&#9744;</span> 

<div class="doc">
<a name="lab101"></a><h2 class="section">Exercise: Power Series</h2>

<div class="paragraph"> </div>

<a name="lab102"></a><h4 class="section">Exercise: 4 stars, standard, optional (dpow2_down)</h4>
 Here is a program that computes the series:
    <span class="inlinecode">1</span> <span class="inlinecode">+</span> <span class="inlinecode">2</span> <span class="inlinecode">+</span> <span class="inlinecode">2^2</span> <span class="inlinecode">+</span> <span class="inlinecode">...</span> <span class="inlinecode">+</span> <span class="inlinecode">2^<span class="id" type="var">m</span></span> <span class="inlinecode">=</span> <span class="inlinecode">2^(<span class="id" type="var">m</span>+1)</span> <span class="inlinecode">-</span> <span class="inlinecode">1</span>

<div class="paragraph"> </div>

<div class="code code-tight">
&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="var">X</span>&nbsp;<span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>:</span>:</span>=</span>&nbsp;0;;<br/>
&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="var">Y</span>&nbsp;<span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>:</span>:</span>=</span>&nbsp;1;;<br/>
&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="var">Z</span>&nbsp;<span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>:</span>:</span>=</span>&nbsp;1;;<br/>
&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="var">WHILE</span>&nbsp;~(<span class="id" type="var">X</span>&nbsp;=&nbsp;<span class="id" type="var">m</span>)&nbsp;<span class="id" type="var">DO</span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="var">Z</span>&nbsp;<span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>:</span>:</span>=</span>&nbsp;2&nbsp;*&nbsp;<span class="id" type="var">Z</span>;;<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="var">Y</span>&nbsp;<span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>:</span>:</span>=</span>&nbsp;<span class="id" type="var">Y</span>&nbsp;+&nbsp;<span class="id" type="var">Z</span>;;<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="var">X</span>&nbsp;<span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>:</span>:</span>=</span>&nbsp;<span class="id" type="var">X</span>&nbsp;+&nbsp;1<br/>
&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="var">END</span>
<div class="paragraph"> </div>

</div>
    Write a decorated program for this. 
</div>
<div class="code code-tight">

<span class="comment">(*&nbsp;FILL&nbsp;IN&nbsp;HERE&nbsp;*)</span><br/>
</div>

<span class="proofbox">&#9744;</span> 

<div class="doc">
<a name="lab103"></a><h1 class="section">Weakest Preconditions (Optional)</h1>

<div class="paragraph"> </div>

 Some Hoare triples are more interesting than others.
    For example,

<div class="paragraph"> </div>

<div class="code code-tight">
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{&nbsp;<span class="id" type="var">False</span>&nbsp;<span style='letter-spacing:-.4em;'>}</span>}&nbsp;&nbsp;<span class="id" type="var">X</span>&nbsp;<span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>:</span>:</span>=</span>&nbsp;<span class="id" type="var">Y</span>&nbsp;+&nbsp;1&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{&nbsp;<span class="id" type="var">X</span>&nbsp;≤&nbsp;5&nbsp;<span style='letter-spacing:-.4em;'>}</span>}
<div class="paragraph"> </div>

</div>
    is <i>not</i> very interesting: although it is perfectly valid, it
    tells us nothing useful.  Since the precondition isn't satisfied
    by any state, it doesn't describe any situations where we can use
    the command <span class="inlinecode"><span class="id" type="var">X</span></span> <span class="inlinecode"><span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>:</span>:</span>=</span></span> <span class="inlinecode"><span class="id" type="var">Y</span></span> <span class="inlinecode">+</span> <span class="inlinecode">1</span> to achieve the postcondition <span class="inlinecode"><span class="id" type="var">X</span></span> <span class="inlinecode">≤</span> <span class="inlinecode">5</span>.

<div class="paragraph"> </div>

    By contrast,

<div class="paragraph"> </div>

<div class="code code-tight">
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{&nbsp;<span class="id" type="var">Y</span>&nbsp;≤&nbsp;4&nbsp;∧&nbsp;<span class="id" type="var">Z</span>&nbsp;=&nbsp;0&nbsp;<span style='letter-spacing:-.4em;'>}</span>}&nbsp;&nbsp;<span class="id" type="var">X</span>&nbsp;<span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>:</span>:</span>=</span>&nbsp;<span class="id" type="var">Y</span>&nbsp;+&nbsp;1&nbsp;<span style='letter-spacing:-.4em;'>{</span>{&nbsp;<span class="id" type="var">X</span>&nbsp;≤&nbsp;5&nbsp;<span style='letter-spacing:-.4em;'>}</span>}
<div class="paragraph"> </div>

</div>
    is useful: it tells us that, if we can somehow create a situation
    in which we know that <span class="inlinecode"><span class="id" type="var">Y</span></span> <span class="inlinecode">≤</span> <span class="inlinecode">4</span> <span class="inlinecode">∧</span> <span class="inlinecode"><span class="id" type="var">Z</span></span> <span class="inlinecode">=</span> <span class="inlinecode">0</span>, then running this command
    will produce a state satisfying the postcondition.  However, this
    triple is still not as useful as it could be, because the <span class="inlinecode"><span class="id" type="var">Z</span></span> <span class="inlinecode">=</span> <span class="inlinecode">0</span>
    clause in the precondition actually has nothing to do with the
    postcondition <span class="inlinecode"><span class="id" type="var">X</span></span> <span class="inlinecode">≤</span> <span class="inlinecode">5</span>.  The <i>most</i> useful triple (for this
    command and postcondition) is this one:

<div class="paragraph"> </div>

<div class="code code-tight">
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{&nbsp;<span class="id" type="var">Y</span>&nbsp;≤&nbsp;4&nbsp;<span style='letter-spacing:-.4em;'>}</span>}&nbsp;&nbsp;<span class="id" type="var">X</span>&nbsp;<span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>:</span>:</span>=</span>&nbsp;<span class="id" type="var">Y</span>&nbsp;+&nbsp;1&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{&nbsp;<span class="id" type="var">X</span>&nbsp;≤&nbsp;5&nbsp;<span style='letter-spacing:-.4em;'>}</span>}
<div class="paragraph"> </div>

</div>
    In other words, <span class="inlinecode"><span class="id" type="var">Y</span></span> <span class="inlinecode">≤</span> <span class="inlinecode">4</span> is the <i>weakest</i> valid precondition of
    the command <span class="inlinecode"><span class="id" type="var">X</span></span> <span class="inlinecode"><span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>:</span>:</span>=</span></span> <span class="inlinecode"><span class="id" type="var">Y</span></span> <span class="inlinecode">+</span> <span class="inlinecode">1</span> for the postcondition <span class="inlinecode"><span class="id" type="var">X</span></span> <span class="inlinecode">≤</span> <span class="inlinecode">5</span>. 
<div class="paragraph"> </div>

 In general, we say that "<span class="inlinecode"><span class="id" type="var">P</span></span> is the weakest precondition of
    command <span class="inlinecode"><span class="id" type="var">c</span></span> for postcondition <span class="inlinecode"><span class="id" type="var">Q</span></span>" if <span class="inlinecode"><span style='letter-spacing:-.4em;'>{</span>{<span class="id" type="var">P</span><span style='letter-spacing:-.4em;'>}</span>}</span> <span class="inlinecode"><span class="id" type="var">c</span></span> <span class="inlinecode"><span style='letter-spacing:-.4em;'>{</span>{<span class="id" type="var">Q</span><span style='letter-spacing:-.4em;'>}</span>}</span> and if,
    whenever <span class="inlinecode"><span class="id" type="var">P'</span></span> is an assertion such that <span class="inlinecode"><span style='letter-spacing:-.4em;'>{</span>{<span class="id" type="var">P'</span><span style='letter-spacing:-.4em;'>}</span>}</span> <span class="inlinecode"><span class="id" type="var">c</span></span> <span class="inlinecode"><span style='letter-spacing:-.4em;'>{</span>{<span class="id" type="var">Q</span><span style='letter-spacing:-.4em;'>}</span>}</span>, it is
    the case that <span class="inlinecode"><span class="id" type="var">P'</span></span> <span class="inlinecode"><span class="id" type="var">st</span></span> implies <span class="inlinecode"><span class="id" type="var">P</span></span> <span class="inlinecode"><span class="id" type="var">st</span></span> for all states <span class="inlinecode"><span class="id" type="var">st</span></span>.  
</div>
<div class="code code-tight">

<span class="id" type="keyword">Definition</span> <span class="id" type="var">is_wp</span> <span class="id" type="var">P</span> <span class="id" type="var">c</span> <span class="id" type="var">Q</span> :=<br/>
&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{<span class="id" type="var">P</span><span style='letter-spacing:-.4em;'>}</span>} <span class="id" type="var">c</span> <span style='letter-spacing:-.4em;'>{</span>{<span class="id" type="var">Q</span><span style='letter-spacing:-.4em;'>}</span>} ∧<br/>
&nbsp;&nbsp;<span style='font-size:120%;'>&forall;</span><span class="id" type="var">P'</span>, <span style='letter-spacing:-.4em;'>{</span>{<span class="id" type="var">P'</span><span style='letter-spacing:-.4em;'>}</span>} <span class="id" type="var">c</span> <span style='letter-spacing:-.4em;'>{</span>{<span class="id" type="var">Q</span><span style='letter-spacing:-.4em;'>}</span>} → (<span class="id" type="var">P'</span> <span class="nowrap"><span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>-</span></span><span style='letter-spacing:-.2em;'>></span>></span></span> <span class="id" type="var">P</span>).<br/>
</div>

<div class="doc">
That is, <span class="inlinecode"><span class="id" type="var">P</span></span> is the weakest precondition of <span class="inlinecode"><span class="id" type="var">c</span></span> for <span class="inlinecode"><span class="id" type="var">Q</span></span>
    if (a) <span class="inlinecode"><span class="id" type="var">P</span></span> <i>is</i> a precondition for <span class="inlinecode"><span class="id" type="var">Q</span></span> and <span class="inlinecode"><span class="id" type="var">c</span></span>, and (b) <span class="inlinecode"><span class="id" type="var">P</span></span> is the
    <i>weakest</i> (easiest to satisfy) assertion that guarantees that
    <span class="inlinecode"><span class="id" type="var">Q</span></span> will hold after executing <span class="inlinecode"><span class="id" type="var">c</span></span>. 
<div class="paragraph"> </div>

<a name="lab104"></a><h4 class="section">Exercise: 1 star, standard, optional (wp)</h4>
 What are the weakest preconditions of the following commands
   for the following postconditions?

<div class="paragraph"> </div>

<div class="code code-tight">
&nbsp;&nbsp;1)&nbsp;<span style='letter-spacing:-.4em;'>{</span>{&nbsp;?&nbsp;<span style='letter-spacing:-.4em;'>}</span>}&nbsp;&nbsp;<span class="id" type="var">SKIP</span>&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{&nbsp;<span class="id" type="var">X</span>&nbsp;=&nbsp;5&nbsp;<span style='letter-spacing:-.4em;'>}</span>}<br/>
<br/>
&nbsp;&nbsp;2)&nbsp;<span style='letter-spacing:-.4em;'>{</span>{&nbsp;?&nbsp;<span style='letter-spacing:-.4em;'>}</span>}&nbsp;&nbsp;<span class="id" type="var">X</span>&nbsp;<span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>:</span>:</span>=</span>&nbsp;<span class="id" type="var">Y</span>&nbsp;+&nbsp;<span class="id" type="var">Z</span>&nbsp;<span style='letter-spacing:-.4em;'>{</span>{&nbsp;<span class="id" type="var">X</span>&nbsp;=&nbsp;5&nbsp;<span style='letter-spacing:-.4em;'>}</span>}<br/>
<br/>
&nbsp;&nbsp;3)&nbsp;<span style='letter-spacing:-.4em;'>{</span>{&nbsp;?&nbsp;<span style='letter-spacing:-.4em;'>}</span>}&nbsp;&nbsp;<span class="id" type="var">X</span>&nbsp;<span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>:</span>:</span>=</span>&nbsp;<span class="id" type="var">Y</span>&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{&nbsp;<span class="id" type="var">X</span>&nbsp;=&nbsp;<span class="id" type="var">Y</span>&nbsp;<span style='letter-spacing:-.4em;'>}</span>}<br/>
<br/>
&nbsp;&nbsp;4)&nbsp;<span style='letter-spacing:-.4em;'>{</span>{&nbsp;?&nbsp;<span style='letter-spacing:-.4em;'>}</span>}<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="var">TEST</span>&nbsp;<span class="id" type="var">X</span>&nbsp;=&nbsp;0&nbsp;<span class="id" type="var">THEN</span>&nbsp;<span class="id" type="var">Y</span>&nbsp;<span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>:</span>:</span>=</span>&nbsp;<span class="id" type="var">Z</span>&nbsp;+&nbsp;1&nbsp;<span class="id" type="var">ELSE</span>&nbsp;<span class="id" type="var">Y</span>&nbsp;<span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>:</span>:</span>=</span>&nbsp;<span class="id" type="var">W</span>&nbsp;+&nbsp;2&nbsp;<span class="id" type="var">FI</span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{&nbsp;<span class="id" type="var">Y</span>&nbsp;=&nbsp;5&nbsp;<span style='letter-spacing:-.4em;'>}</span>}<br/>
<br/>
&nbsp;&nbsp;5)&nbsp;<span style='letter-spacing:-.4em;'>{</span>{&nbsp;?&nbsp;<span style='letter-spacing:-.4em;'>}</span>}<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="var">X</span>&nbsp;<span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>:</span>:</span>=</span>&nbsp;5<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{&nbsp;<span class="id" type="var">X</span>&nbsp;=&nbsp;0&nbsp;<span style='letter-spacing:-.4em;'>}</span>}<br/>
<br/>
&nbsp;&nbsp;6)&nbsp;<span style='letter-spacing:-.4em;'>{</span>{&nbsp;?&nbsp;<span style='letter-spacing:-.4em;'>}</span>}<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="var">WHILE</span>&nbsp;<span class="id" type="var">true</span>&nbsp;<span class="id" type="var">DO</span>&nbsp;<span class="id" type="var">X</span>&nbsp;<span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>:</span>:</span>=</span>&nbsp;0&nbsp;<span class="id" type="var">END</span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{&nbsp;<span class="id" type="var">X</span>&nbsp;=&nbsp;0&nbsp;<span style='letter-spacing:-.4em;'>}</span>}
<div class="paragraph"> </div>

</div>

</div>
<div class="code code-tight">
<span class="comment">(*&nbsp;FILL&nbsp;IN&nbsp;HERE&nbsp;*)</span><br/>
</div>

<span class="proofbox">&#9744;</span> 
<div class="doc less-space">
<div class="paragraph"> </div>

<a name="lab105"></a><h4 class="section">Exercise: 3 stars, advanced, optional (is_wp_formal)</h4>
 Prove formally, using the definition of <span class="inlinecode"><span class="id" type="var">hoare_triple</span></span>, that <span class="inlinecode"><span class="id" type="var">Y</span></span> <span class="inlinecode">≤</span> <span class="inlinecode">4</span>
   is indeed the weakest precondition of <span class="inlinecode"><span class="id" type="var">X</span></span> <span class="inlinecode"><span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>:</span>:</span>=</span></span> <span class="inlinecode"><span class="id" type="var">Y</span></span> <span class="inlinecode">+</span> <span class="inlinecode">1</span> with respect to
   postcondition <span class="inlinecode"><span class="id" type="var">X</span></span> <span class="inlinecode">≤</span> <span class="inlinecode">5</span>. 
</div>
<div class="code code-tight">

<span class="id" type="keyword">Theorem</span> <span class="id" type="var">is_wp_example</span> :<br/>
&nbsp;&nbsp;<span class="id" type="var">is_wp</span> (<span class="id" type="keyword">fun</span> <span class="id" type="var">st</span> ⇒ <span class="id" type="var">st</span> <span class="id" type="var">Y</span> ≤ 4)<br/>
&nbsp;&nbsp;&nbsp;&nbsp;(<span class="id" type="var">X</span> <span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>:</span>:</span>=</span> <span class="id" type="var">Y</span> + 1) (<span class="id" type="keyword">fun</span> <span class="id" type="var">st</span> ⇒ <span class="id" type="var">st</span> <span class="id" type="var">X</span> ≤ 5).<br/>
<span class="id" type="keyword">Proof</span>.<br/>
&nbsp;&nbsp;<span class="comment">(*&nbsp;FILL&nbsp;IN&nbsp;HERE&nbsp;*)</span> <span class="id" type="var">Admitted</span>.<br/>
</div>

<span class="proofbox">&#9744;</span> 
<div class="doc less-space">
<div class="paragraph"> </div>

<a name="lab106"></a><h4 class="section">Exercise: 2 stars, advanced, optional (hoare_asgn_weakest)</h4>
 Show that the precondition in the rule <span class="inlinecode"><span class="id" type="var">hoare_asgn</span></span> is in fact the
    weakest precondition. 
</div>
<div class="code code-tight">

<span class="id" type="keyword">Theorem</span> <span class="id" type="var">hoare_asgn_weakest</span> : <span style='font-size:120%;'>&forall;</span><span class="id" type="var">Q</span> <span class="id" type="var">X</span> <span class="id" type="var">a</span>,<br/>
&nbsp;&nbsp;<span class="id" type="var">is_wp</span> (<span class="id" type="var">Q</span> [<span class="id" type="var">X</span> <span class="nowrap"><span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>&#x22A2;</span><span style='font-size:90%;'>&gt;</span></span></span></span> <span class="id" type="var">a</span>]) (<span class="id" type="var">X</span> <span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>:</span>:</span>=</span> <span class="id" type="var">a</span>) <span class="id" type="var">Q</span>.<br/>
<span class="id" type="keyword">Proof</span>.<br/>
<span class="comment">(*&nbsp;FILL&nbsp;IN&nbsp;HERE&nbsp;*)</span> <span class="id" type="var">Admitted</span>.<br/>
</div>

<span class="proofbox">&#9744;</span> 
<div class="doc less-space">
<div class="paragraph"> </div>

<a name="lab107"></a><h4 class="section">Exercise: 2 stars, advanced, optional (hoare_havoc_weakest)</h4>
 Show that your <span class="inlinecode"><span class="id" type="var">havoc_pre</span></span> rule from the <span class="inlinecode"><span class="id" type="var">himp_hoare</span></span> exercise
    in the <a href="Hoare.html"><span class="inlineref">Hoare</span></a> chapter returns the weakest precondition. 
</div>
<div class="code code-tight">
<span class="id" type="keyword">Module</span> <span class="id" type="var">Himp2</span>.<br/>
<span class="id" type="keyword">Import</span> <span class="id" type="var">Himp</span>.<br/><hr class='doublespaceincode'/>
<span class="id" type="keyword">Lemma</span> <span class="id" type="var">hoare_havoc_weakest</span> : <span style='font-size:120%;'>&forall;</span>(<span class="id" type="var">P</span> <span class="id" type="var">Q</span> : <span class="id" type="var">Assertion</span>) (<span class="id" type="var">X</span> : <span class="id" type="var">string</span>),<br/>
&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{ <span class="id" type="var">P</span> <span style='letter-spacing:-.4em;'>}</span>} <span class="id" type="var">HAVOC</span> <span class="id" type="var">X</span> <span style='letter-spacing:-.4em;'>{</span>{ <span class="id" type="var">Q</span> <span style='letter-spacing:-.4em;'>}</span>} →<br/>
&nbsp;&nbsp;<span class="id" type="var">P</span> <span class="nowrap"><span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>-</span></span><span style='letter-spacing:-.2em;'>></span>></span></span> <span class="id" type="var">havoc_pre</span> <span class="id" type="var">X</span> <span class="id" type="var">Q</span>.<br/>
<span class="id" type="keyword">Proof</span>.<br/>
<span class="comment">(*&nbsp;FILL&nbsp;IN&nbsp;HERE&nbsp;*)</span> <span class="id" type="var">Admitted</span>.<br/>
</div>

<span class="proofbox">&#9744;</span> 

<div class="doc">
<a name="lab108"></a><h1 class="section">Formal Decorated Programs (Advanced)</h1>

<div class="paragraph"> </div>

 Our informal conventions for decorated programs amount to a
    way of displaying Hoare triples, in which commands are annotated
    with enough embedded assertions that checking the validity of a
    triple is reduced to simple logical and algebraic calculations
    showing that some assertions imply others.  In this section, we
    show that this informal presentation style can actually be made
    completely formal and indeed that checking the validity of
    decorated programs can mostly be automated.  
<div class="paragraph"> </div>

<a name="lab109"></a><h2 class="section">Syntax</h2>

<div class="paragraph"> </div>

 The first thing we need to do is to formalize a variant of the
    syntax of commands with embedded assertions.  We call the new
    commands <i>decorated commands</i>, or <span class="inlinecode"><span class="id" type="var">dcom</span></span>s. 
<div class="paragraph"> </div>

 We don't want both preconditions and postconditions on each
    command, because a sequence of two commands would contain
    redundant decorations&mdash;the postcondition of the first likely being
    the same as the precondition of the second. Instead, decorations
    are added corresponding to postconditions only.  A separate type,
    <span class="inlinecode"><span class="id" type="var">decorated</span></span>, is used to add just one precondition for the entire
    program. 
</div>
<div class="code code-tight">

<span class="id" type="keyword">Inductive</span> <span class="id" type="var">dcom</span> : <span class="id" type="keyword">Type</span> :=<br/>
&nbsp;&nbsp;| <span class="id" type="var">DCSkip</span> :  <span class="id" type="var">Assertion</span> → <span class="id" type="var">dcom</span><br/>
&nbsp;&nbsp;| <span class="id" type="var">DCSeq</span> : <span class="id" type="var">dcom</span> → <span class="id" type="var">dcom</span> → <span class="id" type="var">dcom</span><br/>
&nbsp;&nbsp;| <span class="id" type="var">DCAsgn</span> : <span class="id" type="var">string</span> → <span class="id" type="var">aexp</span> →  <span class="id" type="var">Assertion</span> → <span class="id" type="var">dcom</span><br/>
&nbsp;&nbsp;| <span class="id" type="var">DCIf</span> : <span class="id" type="var">bexp</span> →  <span class="id" type="var">Assertion</span> → <span class="id" type="var">dcom</span> →  <span class="id" type="var">Assertion</span> → <span class="id" type="var">dcom</span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;→ <span class="id" type="var">Assertion</span>→ <span class="id" type="var">dcom</span><br/>
&nbsp;&nbsp;| <span class="id" type="var">DCWhile</span> : <span class="id" type="var">bexp</span> → <span class="id" type="var">Assertion</span> → <span class="id" type="var">dcom</span> → <span class="id" type="var">Assertion</span> → <span class="id" type="var">dcom</span><br/>
&nbsp;&nbsp;| <span class="id" type="var">DCPre</span> : <span class="id" type="var">Assertion</span> → <span class="id" type="var">dcom</span> → <span class="id" type="var">dcom</span><br/>
&nbsp;&nbsp;| <span class="id" type="var">DCPost</span> : <span class="id" type="var">dcom</span> → <span class="id" type="var">Assertion</span> → <span class="id" type="var">dcom</span>.<br/><hr class='doublespaceincode'/>
<span class="id" type="keyword">Inductive</span> <span class="id" type="var">decorated</span> : <span class="id" type="keyword">Type</span> :=<br/>
&nbsp;&nbsp;| <span class="id" type="var">Decorated</span> : <span class="id" type="var">Assertion</span> → <span class="id" type="var">dcom</span> → <span class="id" type="var">decorated</span>.<br/><hr class='doublespaceincode'/>
<span class="id" type="keyword">Delimit</span> <span class="id" type="keyword">Scope</span> <span class="id" type="var">default</span> <span class="id" type="keyword">with</span> <span class="id" type="var">default</span>.<br/><hr class='doublespaceincode'/>
<span class="id" type="keyword">Notation</span> "'SKIP' <span style='letter-spacing:-.4em;'>{</span>{ P <span style='letter-spacing:-.4em;'>}</span>}"<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;:= (<span class="id" type="var">DCSkip</span> <span class="id" type="var">P</span>)<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;(<span class="id" type="tactic">at</span> <span class="id" type="var">level</span> 10) : <span class="id" type="var">dcom_scope</span>.<br/>
<span class="id" type="keyword">Notation</span> "l '<span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>:</span>:</span>=</span>' a <span style='letter-spacing:-.4em;'>{</span>{ P <span style='letter-spacing:-.4em;'>}</span>}"<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;:= (<span class="id" type="var">DCAsgn</span> <span class="id" type="var">l</span> <span class="id" type="var">a</span> <span class="id" type="var">P</span>)<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;(<span class="id" type="tactic">at</span> <span class="id" type="var">level</span> 60, <span class="id" type="var">a</span> <span class="id" type="tactic">at</span> <span class="id" type="var">next</span> <span class="id" type="var">level</span>) : <span class="id" type="var">dcom_scope</span>.<br/>
<span class="id" type="keyword">Notation</span> "'WHILE' b 'DO' <span style='letter-spacing:-.4em;'>{</span>{ Pbody <span style='letter-spacing:-.4em;'>}</span>} d 'END' <span style='letter-spacing:-.4em;'>{</span>{ Ppost <span style='letter-spacing:-.4em;'>}</span>}"<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;:= (<span class="id" type="var">DCWhile</span> <span class="id" type="var">b</span> <span class="id" type="var">Pbody</span> <span class="id" type="var">d</span> <span class="id" type="var">Ppost</span>)<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;(<span class="id" type="tactic">at</span> <span class="id" type="var">level</span> 80, <span class="id" type="var">right</span> <span class="id" type="var">associativity</span>) : <span class="id" type="var">dcom_scope</span>.<br/>
<span class="id" type="keyword">Notation</span> "'TEST' b 'THEN' <span style='letter-spacing:-.4em;'>{</span>{ P <span style='letter-spacing:-.4em;'>}</span>} d 'ELSE' <span style='letter-spacing:-.4em;'>{</span>{ P' <span style='letter-spacing:-.4em;'>}</span>} d' 'FI' <span style='letter-spacing:-.4em;'>{</span>{ Q <span style='letter-spacing:-.4em;'>}</span>}"<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;:= (<span class="id" type="var">DCIf</span> <span class="id" type="var">b</span> <span class="id" type="var">P</span> <span class="id" type="var">d</span> <span class="id" type="var">P'</span> <span class="id" type="var">d'</span> <span class="id" type="var">Q</span>)<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;(<span class="id" type="tactic">at</span> <span class="id" type="var">level</span> 80, <span class="id" type="var">right</span> <span class="id" type="var">associativity</span>)  : <span class="id" type="var">dcom_scope</span>.<br/>
<span class="id" type="keyword">Notation</span> "'<span class="nowrap"><span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>-</span></span><span style='letter-spacing:-.2em;'>></span>></span></span>' <span style='letter-spacing:-.4em;'>{</span>{ P <span style='letter-spacing:-.4em;'>}</span>} d"<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;:= (<span class="id" type="var">DCPre</span> <span class="id" type="var">P</span> <span class="id" type="var">d</span>)<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;(<span class="id" type="tactic">at</span> <span class="id" type="var">level</span> 90, <span class="id" type="var">right</span> <span class="id" type="var">associativity</span>)  : <span class="id" type="var">dcom_scope</span>.<br/>
<span class="id" type="keyword">Notation</span> "d '<span class="nowrap"><span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>-</span></span><span style='letter-spacing:-.2em;'>></span>></span></span>' <span style='letter-spacing:-.4em;'>{</span>{ P <span style='letter-spacing:-.4em;'>}</span>}"<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;:= (<span class="id" type="var">DCPost</span> <span class="id" type="var">d</span> <span class="id" type="var">P</span>)<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;(<span class="id" type="tactic">at</span> <span class="id" type="var">level</span> 80, <span class="id" type="var">right</span> <span class="id" type="var">associativity</span>)  : <span class="id" type="var">dcom_scope</span>.<br/>
<span class="id" type="keyword">Notation</span> " d ;; d' "<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;:= (<span class="id" type="var">DCSeq</span> <span class="id" type="var">d</span> <span class="id" type="var">d'</span>)<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;(<span class="id" type="tactic">at</span> <span class="id" type="var">level</span> 80, <span class="id" type="var">right</span> <span class="id" type="var">associativity</span>)  : <span class="id" type="var">dcom_scope</span>.<br/>
<span class="id" type="keyword">Notation</span> "<span style='letter-spacing:-.4em;'>{</span>{ P <span style='letter-spacing:-.4em;'>}</span>} d"<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;:= (<span class="id" type="var">Decorated</span> <span class="id" type="var">P</span> <span class="id" type="var">d</span>)<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;(<span class="id" type="tactic">at</span> <span class="id" type="var">level</span> 90)  : <span class="id" type="var">dcom_scope</span>.<br/><hr class='doublespaceincode'/>
<span class="id" type="keyword">Delimit</span> <span class="id" type="keyword">Scope</span> <span class="id" type="var">dcom_scope</span> <span class="id" type="keyword">with</span> <span class="id" type="var">dcom</span>.<br/>
<span class="id" type="keyword">Open</span> <span class="id" type="keyword">Scope</span> <span class="id" type="var">dcom_scope</span>.<br/><hr class='doublespaceincode'/>
<span class="id" type="keyword">Example</span> <span class="id" type="var">dec0</span> :=<br/>
&nbsp;&nbsp;<span class="id" type="var">SKIP</span> <span style='letter-spacing:-.4em;'>{</span>{ <span class="id" type="keyword">fun</span> <span class="id" type="var">st</span> ⇒ <span class="id" type="var">True</span> <span style='letter-spacing:-.4em;'>}</span>}.<br/>
<span class="id" type="keyword">Example</span> <span class="id" type="var">dec1</span> :=<br/>
&nbsp;&nbsp;<span class="id" type="var">WHILE</span> <span class="id" type="var">true</span> <span class="id" type="var">DO</span> <span style='letter-spacing:-.4em;'>{</span>{ <span class="id" type="keyword">fun</span> <span class="id" type="var">st</span> ⇒ <span class="id" type="var">True</span> <span style='letter-spacing:-.4em;'>}</span>} <span class="id" type="var">SKIP</span> <span style='letter-spacing:-.4em;'>{</span>{ <span class="id" type="keyword">fun</span> <span class="id" type="var">st</span> ⇒ <span class="id" type="var">True</span> <span style='letter-spacing:-.4em;'>}</span>} <span class="id" type="var">END</span><br/>
&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{ <span class="id" type="keyword">fun</span> <span class="id" type="var">st</span> ⇒ <span class="id" type="var">True</span> <span style='letter-spacing:-.4em;'>}</span>}.<br/>
<span class="id" type="keyword">Set</span> <span class="id" type="var">Printing</span> <span class="id" type="var">All</span>.<br/>
</div>

<div class="doc">
To avoid clashing with the existing <span class="inlinecode"><span class="id" type="keyword">Notation</span></span> definitions for
    ordinary <span class="inlinecode"><span class="id" type="var">com</span></span>mands, we introduce these notations in a special
    scope called <span class="inlinecode"><span class="id" type="var">dcom_scope</span></span>, and we <span class="inlinecode"><span class="id" type="keyword">Open</span></span> this scope for the
    remainder of the file.

<div class="paragraph"> </div>

    Careful readers will note that we've defined two notations
    for specifying a precondition explicitly, one with and one
    without a <span class="inlinecode"><span class="nowrap"><span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>-</span></span><span style='letter-spacing:-.2em;'>></span>></span></span></span>.  The "without" version is intended to be
    used to supply the initial precondition at the very top
    of the program. 
</div>
<div class="code code-tight">

<span class="id" type="keyword">Example</span> <span class="id" type="var">dec_while</span> : <span class="id" type="var">decorated</span> :=<br/>
&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{ <span class="id" type="keyword">fun</span> <span class="id" type="var">st</span> ⇒ <span class="id" type="var">True</span> <span style='letter-spacing:-.4em;'>}</span>} <br/>
&nbsp;&nbsp;<span class="id" type="var">WHILE</span> ~(<span class="id" type="var">X</span> = 0)<br/>
&nbsp;&nbsp;<span class="id" type="var">DO</span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{ <span class="id" type="keyword">fun</span> <span class="id" type="var">st</span> ⇒ <span class="id" type="var">True</span> ∧ <span class="id" type="var">st</span> <span class="id" type="var">X</span> ≠ 0<span style='letter-spacing:-.4em;'>}</span>}<br/>
&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="var">X</span> <span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>:</span>:</span>=</span> <span class="id" type="var">X</span> - 1<br/>
&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{ <span class="id" type="keyword">fun</span> <span class="id" type="var">_</span> ⇒ <span class="id" type="var">True</span> <span style='letter-spacing:-.4em;'>}</span>}<br/>
&nbsp;&nbsp;<span class="id" type="var">END</span><br/>
&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{ <span class="id" type="keyword">fun</span> <span class="id" type="var">st</span> ⇒ <span class="id" type="var">True</span> ∧ <span class="id" type="var">st</span> <span class="id" type="var">X</span> = 0<span style='letter-spacing:-.4em;'>}</span>} <span class="nowrap"><span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>-</span></span><span style='letter-spacing:-.2em;'>></span>></span></span><br/>
&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{ <span class="id" type="keyword">fun</span> <span class="id" type="var">st</span> ⇒ <span class="id" type="var">st</span> <span class="id" type="var">X</span> = 0 <span style='letter-spacing:-.4em;'>}</span>}.<br/>
</div>

<div class="doc">
It is easy to go from a <span class="inlinecode"><span class="id" type="var">dcom</span></span> to a <span class="inlinecode"><span class="id" type="var">com</span></span> by erasing all
    annotations. 
</div>
<div class="code code-tight">

<span class="id" type="keyword">Fixpoint</span> <span class="id" type="var">extract</span> (<span class="id" type="var">d</span> : <span class="id" type="var">dcom</span>) : <span class="id" type="var">com</span> :=<br/>
&nbsp;&nbsp;<span class="id" type="keyword">match</span> <span class="id" type="var">d</span> <span class="id" type="keyword">with</span><br/>
&nbsp;&nbsp;| <span class="id" type="var">DCSkip</span> <span class="id" type="var">_</span>           ⇒ <span class="id" type="var">SKIP</span><br/>
&nbsp;&nbsp;| <span class="id" type="var">DCSeq</span> <span class="id" type="var">d<sub>1</sub></span> <span class="id" type="var">d<sub>2</sub></span>        ⇒ (<span class="id" type="var">extract</span> <span class="id" type="var">d<sub>1</sub></span> ;; <span class="id" type="var">extract</span> <span class="id" type="var">d<sub>2</sub></span>)<br/>
&nbsp;&nbsp;| <span class="id" type="var">DCAsgn</span> <span class="id" type="var">X</span> <span class="id" type="var">a</span> <span class="id" type="var">_</span>       ⇒ <span class="id" type="var">X</span> <span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>:</span>:</span>=</span> <span class="id" type="var">a</span><br/>
&nbsp;&nbsp;| <span class="id" type="var">DCIf</span> <span class="id" type="var">b</span> <span class="id" type="var">_</span> <span class="id" type="var">d<sub>1</sub></span> <span class="id" type="var">_</span> <span class="id" type="var">d<sub>2</sub></span> <span class="id" type="var">_</span> ⇒ <span class="id" type="var">TEST</span> <span class="id" type="var">b</span> <span class="id" type="var">THEN</span> <span class="id" type="var">extract</span> <span class="id" type="var">d<sub>1</sub></span> <span class="id" type="var">ELSE</span> <span class="id" type="var">extract</span> <span class="id" type="var">d<sub>2</sub></span> <span class="id" type="var">FI</span><br/>
&nbsp;&nbsp;| <span class="id" type="var">DCWhile</span> <span class="id" type="var">b</span> <span class="id" type="var">_</span> <span class="id" type="var">d</span> <span class="id" type="var">_</span>    ⇒ <span class="id" type="var">WHILE</span> <span class="id" type="var">b</span> <span class="id" type="var">DO</span> <span class="id" type="var">extract</span> <span class="id" type="var">d</span> <span class="id" type="var">END</span><br/>
&nbsp;&nbsp;| <span class="id" type="var">DCPre</span> <span class="id" type="var">_</span> <span class="id" type="var">d</span>          ⇒ <span class="id" type="var">extract</span> <span class="id" type="var">d</span><br/>
&nbsp;&nbsp;| <span class="id" type="var">DCPost</span> <span class="id" type="var">d</span> <span class="id" type="var">_</span>         ⇒ <span class="id" type="var">extract</span> <span class="id" type="var">d</span><br/>
&nbsp;&nbsp;<span class="id" type="keyword">end</span>.<br/><hr class='doublespaceincode'/>
<span class="id" type="keyword">Definition</span> <span class="id" type="var">extract_dec</span> (<span class="id" type="var">dec</span> : <span class="id" type="var">decorated</span>) : <span class="id" type="var">com</span> :=<br/>
&nbsp;&nbsp;<span class="id" type="keyword">match</span> <span class="id" type="var">dec</span> <span class="id" type="keyword">with</span><br/>
&nbsp;&nbsp;| <span class="id" type="var">Decorated</span> <span class="id" type="var">P</span> <span class="id" type="var">d</span> ⇒ <span class="id" type="var">extract</span> <span class="id" type="var">d</span><br/>
&nbsp;&nbsp;<span class="id" type="keyword">end</span>.<br/>
</div>

<div class="doc">
The choice of exactly where to put assertions in the definition of
    <span class="inlinecode"><span class="id" type="var">dcom</span></span> is a bit subtle.  The simplest thing to do would be to
    annotate every <span class="inlinecode"><span class="id" type="var">dcom</span></span> with a precondition and postcondition.  But
    this would result in very verbose programs with a lot of repeated
    annotations: for example, a program like <span class="inlinecode"><span class="id" type="var">SKIP</span>;<span class="id" type="var">SKIP</span></span> would have to
    be annotated as

<div class="paragraph"> </div>

<div class="code code-tight">
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{<span class="id" type="var">P</span><span style='letter-spacing:-.4em;'>}</span>}&nbsp;(<span style='letter-spacing:-.4em;'>{</span>{<span class="id" type="var">P</span><span style='letter-spacing:-.4em;'>}</span>}&nbsp;<span class="id" type="var">SKIP</span>&nbsp;<span style='letter-spacing:-.4em;'>{</span>{<span class="id" type="var">P</span><span style='letter-spacing:-.4em;'>}</span>})&nbsp;;;&nbsp;(<span style='letter-spacing:-.4em;'>{</span>{<span class="id" type="var">P</span><span style='letter-spacing:-.4em;'>}</span>}&nbsp;<span class="id" type="var">SKIP</span>&nbsp;<span style='letter-spacing:-.4em;'>{</span>{<span class="id" type="var">P</span><span style='letter-spacing:-.4em;'>}</span>})&nbsp;<span style='letter-spacing:-.4em;'>{</span>{<span class="id" type="var">P</span><span style='letter-spacing:-.4em;'>}</span>},
<div class="paragraph"> </div>

</div>
    with pre- and post-conditions on each <span class="inlinecode"><span class="id" type="var">SKIP</span></span>, plus identical pre-
    and post-conditions on the semicolon!

<div class="paragraph"> </div>

    Instead, the rule we've followed is this:

<div class="paragraph"> </div>

<ul class="doclist">
<li> The <i>post</i>-condition expected by each <span class="inlinecode"><span class="id" type="var">dcom</span></span> <span class="inlinecode"><span class="id" type="var">d</span></span> is embedded
         in <span class="inlinecode"><span class="id" type="var">d</span></span>.

<div class="paragraph"> </div>


</li>
<li> The <i>pre</i>-condition is supplied by the context. 
</li>
</ul>

<div class="paragraph"> </div>

 In other words, the invariant of the representation is that a
    <span class="inlinecode"><span class="id" type="var">dcom</span></span> <span class="inlinecode"><span class="id" type="var">d</span></span> together with a precondition <span class="inlinecode"><span class="id" type="var">P</span></span> determines a Hoare
    triple <span class="inlinecode"><span style='letter-spacing:-.4em;'>{</span>{<span class="id" type="var">P</span><span style='letter-spacing:-.4em;'>}</span>}</span> <span class="inlinecode">(<span class="id" type="var">extract</span></span> <span class="inlinecode"><span class="id" type="var">d</span>)</span> <span class="inlinecode"><span style='letter-spacing:-.4em;'>{</span>{<span class="id" type="var">post</span></span> <span class="inlinecode"><span class="id" type="var">d</span><span style='letter-spacing:-.4em;'>}</span>}</span>, where <span class="inlinecode"><span class="id" type="var">post</span></span> is defined as
    follows: 
</div>
<div class="code code-tight">

<span class="id" type="keyword">Fixpoint</span> <span class="id" type="var">post</span> (<span class="id" type="var">d</span> : <span class="id" type="var">dcom</span>) : <span class="id" type="var">Assertion</span> :=<br/>
&nbsp;&nbsp;<span class="id" type="keyword">match</span> <span class="id" type="var">d</span> <span class="id" type="keyword">with</span><br/>
&nbsp;&nbsp;| <span class="id" type="var">DCSkip</span> <span class="id" type="var">P</span>                ⇒ <span class="id" type="var">P</span><br/>
&nbsp;&nbsp;| <span class="id" type="var">DCSeq</span> <span class="id" type="var">d<sub>1</sub></span> <span class="id" type="var">d<sub>2</sub></span>             ⇒ <span class="id" type="var">post</span> <span class="id" type="var">d<sub>2</sub></span><br/>
&nbsp;&nbsp;| <span class="id" type="var">DCAsgn</span> <span class="id" type="var">X</span> <span class="id" type="var">a</span> <span class="id" type="var">Q</span>            ⇒ <span class="id" type="var">Q</span><br/>
&nbsp;&nbsp;| <span class="id" type="var">DCIf</span>  <span class="id" type="var">_</span> <span class="id" type="var">_</span> <span class="id" type="var">d<sub>1</sub></span> <span class="id" type="var">_</span> <span class="id" type="var">d<sub>2</sub></span> <span class="id" type="var">Q</span>     ⇒ <span class="id" type="var">Q</span><br/>
&nbsp;&nbsp;| <span class="id" type="var">DCWhile</span> <span class="id" type="var">b</span> <span class="id" type="var">Pbody</span> <span class="id" type="var">c</span> <span class="id" type="var">Ppost</span> ⇒ <span class="id" type="var">Ppost</span><br/>
&nbsp;&nbsp;| <span class="id" type="var">DCPre</span> <span class="id" type="var">_</span> <span class="id" type="var">d</span>               ⇒ <span class="id" type="var">post</span> <span class="id" type="var">d</span><br/>
&nbsp;&nbsp;| <span class="id" type="var">DCPost</span> <span class="id" type="var">c</span> <span class="id" type="var">Q</span>              ⇒ <span class="id" type="var">Q</span><br/>
&nbsp;&nbsp;<span class="id" type="keyword">end</span>.<br/>
</div>

<div class="doc">
It is straightforward to extract the precondition and
    postcondition from a decorated program. 
</div>
<div class="code code-tight">

<span class="id" type="keyword">Definition</span> <span class="id" type="var">pre_dec</span> (<span class="id" type="var">dec</span> : <span class="id" type="var">decorated</span>) : <span class="id" type="var">Assertion</span> :=<br/>
&nbsp;&nbsp;<span class="id" type="keyword">match</span> <span class="id" type="var">dec</span> <span class="id" type="keyword">with</span><br/>
&nbsp;&nbsp;| <span class="id" type="var">Decorated</span> <span class="id" type="var">P</span> <span class="id" type="var">d</span> ⇒ <span class="id" type="var">P</span><br/>
&nbsp;&nbsp;<span class="id" type="keyword">end</span>.<br/><hr class='doublespaceincode'/>
<span class="id" type="keyword">Definition</span> <span class="id" type="var">post_dec</span> (<span class="id" type="var">dec</span> : <span class="id" type="var">decorated</span>) : <span class="id" type="var">Assertion</span> :=<br/>
&nbsp;&nbsp;<span class="id" type="keyword">match</span> <span class="id" type="var">dec</span> <span class="id" type="keyword">with</span><br/>
&nbsp;&nbsp;| <span class="id" type="var">Decorated</span> <span class="id" type="var">P</span> <span class="id" type="var">d</span> ⇒ <span class="id" type="var">post</span> <span class="id" type="var">d</span><br/>
&nbsp;&nbsp;<span class="id" type="keyword">end</span>.<br/>
</div>

<div class="doc">
We can express what it means for a decorated program to be
    correct as follows: 
</div>
<div class="code code-tight">

<span class="id" type="keyword">Definition</span> <span class="id" type="var">dec_correct</span> (<span class="id" type="var">dec</span> : <span class="id" type="var">decorated</span>) :=<br/>
&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{<span class="id" type="var">pre_dec</span> <span class="id" type="var">dec</span><span style='letter-spacing:-.4em;'>}</span>} (<span class="id" type="var">extract_dec</span> <span class="id" type="var">dec</span>) <span style='letter-spacing:-.4em;'>{</span>{<span class="id" type="var">post_dec</span> <span class="id" type="var">dec</span><span style='letter-spacing:-.4em;'>}</span>}.<br/>
</div>

<div class="doc">
To check whether this Hoare triple is <i>valid</i>, we need a way to
    extract the "proof obligations" from a decorated program.  These
    obligations are often called <i>verification conditions</i>, because
    they are the facts that must be verified to see that the
    decorations are logically consistent and thus add up to a complete
    proof of correctness. 
<div class="paragraph"> </div>

<a name="lab110"></a><h2 class="section">Extracting Verification Conditions</h2>

<div class="paragraph"> </div>

 The function <span class="inlinecode"><span class="id" type="var">verification_conditions</span></span> takes a <span class="inlinecode"><span class="id" type="var">dcom</span></span> <span class="inlinecode"><span class="id" type="var">d</span></span> together
    with a precondition <span class="inlinecode"><span class="id" type="var">P</span></span> and returns a <i>proposition</i> that, if it
    can be proved, implies that the triple <span class="inlinecode"><span style='letter-spacing:-.4em;'>{</span>{<span class="id" type="var">P</span><span style='letter-spacing:-.4em;'>}</span>}</span> <span class="inlinecode">(<span class="id" type="var">extract</span></span> <span class="inlinecode"><span class="id" type="var">d</span>)</span> <span class="inlinecode"><span style='letter-spacing:-.4em;'>{</span>{<span class="id" type="var">post</span></span> <span class="inlinecode"><span class="id" type="var">d</span><span style='letter-spacing:-.4em;'>}</span>}</span>
    is valid. 
<div class="paragraph"> </div>

 It does this by walking over <span class="inlinecode"><span class="id" type="var">d</span></span> and generating a big
    conjunction including all the "local checks" that we listed when
    we described the informal rules for decorated programs.  (Strictly
    speaking, we need to massage the informal rules a little bit to
    add some uses of the rule of consequence, but the correspondence
    should be clear.) 
</div>
<div class="code code-tight">

<span class="id" type="keyword">Fixpoint</span> <span class="id" type="var">verification_conditions</span> (<span class="id" type="var">P</span> : <span class="id" type="var">Assertion</span>) (<span class="id" type="var">d</span> : <span class="id" type="var">dcom</span>) : <span class="id" type="keyword">Prop</span> :=<br/>
&nbsp;&nbsp;<span class="id" type="keyword">match</span> <span class="id" type="var">d</span> <span class="id" type="keyword">with</span><br/>
&nbsp;&nbsp;| <span class="id" type="var">DCSkip</span> <span class="id" type="var">Q</span> ⇒<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;(<span class="id" type="var">P</span> <span class="nowrap"><span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>-</span></span><span style='letter-spacing:-.2em;'>></span>></span></span> <span class="id" type="var">Q</span>)<br/>
&nbsp;&nbsp;| <span class="id" type="var">DCSeq</span> <span class="id" type="var">d<sub>1</sub></span> <span class="id" type="var">d<sub>2</sub></span> ⇒<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="var">verification_conditions</span> <span class="id" type="var">P</span> <span class="id" type="var">d<sub>1</sub></span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;∧ <span class="id" type="var">verification_conditions</span> (<span class="id" type="var">post</span> <span class="id" type="var">d<sub>1</sub></span>) <span class="id" type="var">d<sub>2</sub></span><br/>
&nbsp;&nbsp;| <span class="id" type="var">DCAsgn</span> <span class="id" type="var">X</span> <span class="id" type="var">a</span> <span class="id" type="var">Q</span> ⇒<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;(<span class="id" type="var">P</span> <span class="nowrap"><span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>-</span></span><span style='letter-spacing:-.2em;'>></span>></span></span> <span class="id" type="var">Q</span> [<span class="id" type="var">X</span> <span class="nowrap"><span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>&#x22A2;</span><span style='font-size:90%;'>&gt;</span></span></span></span> <span class="id" type="var">a</span>])<br/>
&nbsp;&nbsp;| <span class="id" type="var">DCIf</span> <span class="id" type="var">b</span> <span class="id" type="var">P<sub>1</sub></span> <span class="id" type="var">d<sub>1</sub></span> <span class="id" type="var">P<sub>2</sub></span> <span class="id" type="var">d<sub>2</sub></span> <span class="id" type="var">Q</span> ⇒<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;((<span class="id" type="keyword">fun</span> <span class="id" type="var">st</span> ⇒ <span class="id" type="var">P</span> <span class="id" type="var">st</span> ∧ <span class="id" type="var">bassn</span> <span class="id" type="var">b</span> <span class="id" type="var">st</span>) <span class="nowrap"><span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>-</span></span><span style='letter-spacing:-.2em;'>></span>></span></span> <span class="id" type="var">P<sub>1</sub></span>)<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;∧ ((<span class="id" type="keyword">fun</span> <span class="id" type="var">st</span> ⇒ <span class="id" type="var">P</span> <span class="id" type="var">st</span> ∧ ¬(<span class="id" type="var">bassn</span> <span class="id" type="var">b</span> <span class="id" type="var">st</span>)) <span class="nowrap"><span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>-</span></span><span style='letter-spacing:-.2em;'>></span>></span></span> <span class="id" type="var">P<sub>2</sub></span>)<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;∧ (<span class="id" type="var">post</span> <span class="id" type="var">d<sub>1</sub></span> <span class="nowrap"><span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>-</span></span><span style='letter-spacing:-.2em;'>></span>></span></span> <span class="id" type="var">Q</span>) ∧ (<span class="id" type="var">post</span> <span class="id" type="var">d<sub>2</sub></span> <span class="nowrap"><span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>-</span></span><span style='letter-spacing:-.2em;'>></span>></span></span> <span class="id" type="var">Q</span>)<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;∧ <span class="id" type="var">verification_conditions</span> <span class="id" type="var">P<sub>1</sub></span> <span class="id" type="var">d<sub>1</sub></span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;∧ <span class="id" type="var">verification_conditions</span> <span class="id" type="var">P<sub>2</sub></span> <span class="id" type="var">d<sub>2</sub></span><br/>
&nbsp;&nbsp;| <span class="id" type="var">DCWhile</span> <span class="id" type="var">b</span> <span class="id" type="var">Pbody</span> <span class="id" type="var">d</span> <span class="id" type="var">Ppost</span> ⇒<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="comment">(*&nbsp;post&nbsp;d&nbsp;is&nbsp;the&nbsp;loop&nbsp;invariant&nbsp;and&nbsp;the&nbsp;initial<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;precondition&nbsp;*)</span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;(<span class="id" type="var">P</span> <span class="nowrap"><span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>-</span></span><span style='letter-spacing:-.2em;'>></span>></span></span> <span class="id" type="var">post</span> <span class="id" type="var">d</span>)<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;∧ ((<span class="id" type="keyword">fun</span> <span class="id" type="var">st</span> ⇒ <span class="id" type="var">post</span> <span class="id" type="var">d</span> <span class="id" type="var">st</span> ∧ <span class="id" type="var">bassn</span> <span class="id" type="var">b</span> <span class="id" type="var">st</span>) <span class="nowrap"><span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>-</span></span><span style='letter-spacing:-.2em;'>></span>></span></span> <span class="id" type="var">Pbody</span>)<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;∧ ((<span class="id" type="keyword">fun</span> <span class="id" type="var">st</span> ⇒ <span class="id" type="var">post</span> <span class="id" type="var">d</span> <span class="id" type="var">st</span> ∧ ~(<span class="id" type="var">bassn</span> <span class="id" type="var">b</span> <span class="id" type="var">st</span>)) <span class="nowrap"><span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>-</span></span><span style='letter-spacing:-.2em;'>></span>></span></span> <span class="id" type="var">Ppost</span>)<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;∧ <span class="id" type="var">verification_conditions</span> <span class="id" type="var">Pbody</span> <span class="id" type="var">d</span><br/>
&nbsp;&nbsp;| <span class="id" type="var">DCPre</span> <span class="id" type="var">P'</span> <span class="id" type="var">d</span> ⇒<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;(<span class="id" type="var">P</span> <span class="nowrap"><span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>-</span></span><span style='letter-spacing:-.2em;'>></span>></span></span> <span class="id" type="var">P'</span>) ∧ <span class="id" type="var">verification_conditions</span> <span class="id" type="var">P'</span> <span class="id" type="var">d</span><br/>
&nbsp;&nbsp;| <span class="id" type="var">DCPost</span> <span class="id" type="var">d</span> <span class="id" type="var">Q</span> ⇒<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="var">verification_conditions</span> <span class="id" type="var">P</span> <span class="id" type="var">d</span> ∧ (<span class="id" type="var">post</span> <span class="id" type="var">d</span> <span class="nowrap"><span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>-</span></span><span style='letter-spacing:-.2em;'>></span>></span></span> <span class="id" type="var">Q</span>)<br/>
&nbsp;&nbsp;<span class="id" type="keyword">end</span>.<br/>
</div>

<div class="doc">
And now the key theorem, stating that <span class="inlinecode"><span class="id" type="var">verification_conditions</span></span>
    does its job correctly.  Not surprisingly, we need to use each of
    the Hoare Logic rules at some point in the proof. 
</div>
<div class="code code-tight">

<span class="id" type="keyword">Theorem</span> <span class="id" type="var">verification_correct</span> : <span style='font-size:120%;'>&forall;</span><span class="id" type="var">d</span> <span class="id" type="var">P</span>,<br/>
&nbsp;&nbsp;<span class="id" type="var">verification_conditions</span> <span class="id" type="var">P</span> <span class="id" type="var">d</span> → <span style='letter-spacing:-.4em;'>{</span>{<span class="id" type="var">P</span><span style='letter-spacing:-.4em;'>}</span>} (<span class="id" type="var">extract</span> <span class="id" type="var">d</span>) <span style='letter-spacing:-.4em;'>{</span>{<span class="id" type="var">post</span> <span class="id" type="var">d</span><span style='letter-spacing:-.4em;'>}</span>}.<br/>
<div class="togglescript" id="proofcontrol4" onclick="toggleDisplay('proof4');toggleDisplay('proofcontrol4')"><span class="show"></span></div>
<div class="proofscript" id="proof4" onclick="toggleDisplay('proof4');toggleDisplay('proofcontrol4')">
<span class="id" type="keyword">Proof</span>.<br/>
&nbsp;&nbsp;<span class="id" type="tactic">induction</span> <span class="id" type="var">d</span>; <span class="id" type="tactic">intros</span> <span class="id" type="var">P</span> <span class="id" type="var">H</span>; <span class="id" type="tactic">simpl</span> <span class="id" type="keyword">in</span> *.<br/>
&nbsp;&nbsp;- <span class="comment">(*&nbsp;Skip&nbsp;*)</span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="tactic">eapply</span> <span class="id" type="var">hoare_consequence_pre</span>.<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="tactic">apply</span> <span class="id" type="var">hoare_skip</span>.<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="tactic">assumption</span>.<br/>
&nbsp;&nbsp;- <span class="comment">(*&nbsp;Seq&nbsp;*)</span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="tactic">destruct</span> <span class="id" type="var">H</span> <span class="id" type="keyword">as</span> [<span class="id" type="var">H<sub>1</sub></span> <span class="id" type="var">H<sub>2</sub></span>].<br/>
&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="tactic">eapply</span> <span class="id" type="var">hoare_seq</span>.<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="tactic">apply</span> <span class="id" type="var">IHd2</span>. <span class="id" type="tactic">apply</span> <span class="id" type="var">H<sub>2</sub></span>.<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="tactic">apply</span> <span class="id" type="var">IHd1</span>. <span class="id" type="tactic">apply</span> <span class="id" type="var">H<sub>1</sub></span>.<br/>
&nbsp;&nbsp;- <span class="comment">(*&nbsp;Asgn&nbsp;*)</span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="tactic">eapply</span> <span class="id" type="var">hoare_consequence_pre</span>.<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="tactic">apply</span> <span class="id" type="var">hoare_asgn</span>.<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="tactic">assumption</span>.<br/>
&nbsp;&nbsp;- <span class="comment">(*&nbsp;If&nbsp;*)</span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="tactic">destruct</span> <span class="id" type="var">H</span> <span class="id" type="keyword">as</span> [<span class="id" type="var">HPre1</span> [<span class="id" type="var">HPre2</span> [<span class="id" type="var">Hd<sub>1</sub></span> [<span class="id" type="var">Hd<sub>2</sub></span> [<span class="id" type="var">HThen</span> <span class="id" type="var">HElse</span>]]]]].<br/>
&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="tactic">apply</span> <span class="id" type="var">IHd1</span> <span class="id" type="keyword">in</span> <span class="id" type="var">HThen</span>. <span class="id" type="tactic">clear</span> <span class="id" type="var">IHd1</span>.<br/>
&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="tactic">apply</span> <span class="id" type="var">IHd2</span> <span class="id" type="keyword">in</span> <span class="id" type="var">HElse</span>. <span class="id" type="tactic">clear</span> <span class="id" type="var">IHd2</span>.<br/>
&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="tactic">apply</span> <span class="id" type="var">hoare_if</span>.<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;+ <span class="id" type="tactic">eapply</span> <span class="id" type="var">hoare_consequence_post</span> <span class="id" type="keyword">with</span> (<span class="id" type="var">Q'</span>:=<span class="id" type="var">post</span> <span class="id" type="var">d<sub>1</sub></span>); <span class="id" type="tactic">eauto</span>.<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="tactic">eapply</span> <span class="id" type="var">hoare_consequence_pre</span>; <span class="id" type="tactic">eauto</span>.<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;+ <span class="id" type="tactic">eapply</span> <span class="id" type="var">hoare_consequence_post</span> <span class="id" type="keyword">with</span> (<span class="id" type="var">Q'</span>:=<span class="id" type="var">post</span> <span class="id" type="var">d<sub>2</sub></span>); <span class="id" type="tactic">eauto</span>.<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="tactic">eapply</span> <span class="id" type="var">hoare_consequence_pre</span>; <span class="id" type="tactic">eauto</span>.<br/>
&nbsp;&nbsp;- <span class="comment">(*&nbsp;While&nbsp;*)</span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="tactic">destruct</span> <span class="id" type="var">H</span> <span class="id" type="keyword">as</span> [<span class="id" type="var">Hpre</span> [<span class="id" type="var">Hbody1</span> [<span class="id" type="var">Hpost1</span>  <span class="id" type="var">Hd</span>]]].<br/>
&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="tactic">eapply</span> <span class="id" type="var">hoare_consequence_pre</span>; <span class="id" type="tactic">eauto</span>.<br/>
&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="tactic">eapply</span> <span class="id" type="var">hoare_consequence_post</span>; <span class="id" type="tactic">eauto</span>.<br/>
&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="tactic">apply</span> <span class="id" type="var">hoare_while</span>.<br/>
&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="tactic">eapply</span> <span class="id" type="var">hoare_consequence_pre</span>; <span class="id" type="tactic">eauto</span>.<br/>
&nbsp;&nbsp;- <span class="comment">(*&nbsp;Pre&nbsp;*)</span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="tactic">destruct</span> <span class="id" type="var">H</span> <span class="id" type="keyword">as</span> [<span class="id" type="var">HP</span> <span class="id" type="var">Hd</span>].<br/>
&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="tactic">eapply</span> <span class="id" type="var">hoare_consequence_pre</span>. <span class="id" type="tactic">apply</span> <span class="id" type="var">IHd</span>. <span class="id" type="tactic">apply</span> <span class="id" type="var">Hd</span>. <span class="id" type="tactic">assumption</span>.<br/>
&nbsp;&nbsp;- <span class="comment">(*&nbsp;Post&nbsp;*)</span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="tactic">destruct</span> <span class="id" type="var">H</span> <span class="id" type="keyword">as</span> [<span class="id" type="var">Hd</span> <span class="id" type="var">HQ</span>].<br/>
&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="tactic">eapply</span> <span class="id" type="var">hoare_consequence_post</span>. <span class="id" type="tactic">apply</span> <span class="id" type="var">IHd</span>. <span class="id" type="tactic">apply</span> <span class="id" type="var">Hd</span>. <span class="id" type="tactic">assumption</span>.<br/>
<span class="id" type="keyword">Qed</span>.<br/>
</div>
</div>

<div class="doc">
<a name="lab111"></a><h2 class="section">Automation</h2>

<div class="paragraph"> </div>

 Now that all the pieces are in place, we can verify an entire program. 
</div>
<div class="code code-tight">

<span class="id" type="keyword">Definition</span> <span class="id" type="var">verification_conditions_dec</span> (<span class="id" type="var">dec</span> : <span class="id" type="var">decorated</span>) : <span class="id" type="keyword">Prop</span> :=<br/>
&nbsp;&nbsp;<span class="id" type="keyword">match</span> <span class="id" type="var">dec</span> <span class="id" type="keyword">with</span><br/>
&nbsp;&nbsp;| <span class="id" type="var">Decorated</span> <span class="id" type="var">P</span> <span class="id" type="var">d</span> ⇒ <span class="id" type="var">verification_conditions</span> <span class="id" type="var">P</span> <span class="id" type="var">d</span><br/>
&nbsp;&nbsp;<span class="id" type="keyword">end</span>.<br/><hr class='doublespaceincode'/>
<span class="id" type="keyword">Lemma</span> <span class="id" type="var">verification_correct_dec</span> : <span style='font-size:120%;'>&forall;</span><span class="id" type="var">dec</span>,<br/>
&nbsp;&nbsp;<span class="id" type="var">verification_conditions_dec</span> <span class="id" type="var">dec</span> → <span class="id" type="var">dec_correct</span> <span class="id" type="var">dec</span>.<br/>
<span class="id" type="keyword">Proof</span>.<br/>
&nbsp;&nbsp;<span class="id" type="tactic">intros</span> [<span class="id" type="var">P</span> <span class="id" type="var">d</span>]. <span class="id" type="tactic">apply</span> <span class="id" type="var">verification_correct</span>.<br/>
<span class="id" type="keyword">Qed</span>.<br/>
</div>

<div class="doc">
The propositions generated by <span class="inlinecode"><span class="id" type="var">verification_conditions</span></span> are fairly
    big, and they contain many conjuncts that are essentially trivial. 
</div>
<div class="code code-tight">

<span class="id" type="keyword">Eval</span> <span class="id" type="tactic">simpl</span> <span class="id" type="keyword">in</span> (<span class="id" type="var">verification_conditions_dec</span> <span class="id" type="var">dec_while</span>).<br/>
</div>

<div class="doc">

<div class="paragraph"> </div>

<div class="code code-tight">
&nbsp;&nbsp;&nbsp;===&gt;<br/>
&nbsp;&nbsp;&nbsp;&nbsp;(((<span class="id" type="keyword">fun</span>&nbsp;<span class="id" type="var">_</span>&nbsp;:&nbsp;<span class="id" type="var">state</span>&nbsp;⇒&nbsp;<span class="id" type="var">True</span>)&nbsp;<span class="nowrap"><span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>-</span></span><span style='letter-spacing:-.2em;'>></span>></span></span>&nbsp;(<span class="id" type="keyword">fun</span>&nbsp;<span class="id" type="var">_</span>&nbsp;:&nbsp;<span class="id" type="var">state</span>&nbsp;⇒&nbsp;<span class="id" type="var">True</span>))&nbsp;∧<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;((<span class="id" type="keyword">fun</span>&nbsp;<span class="id" type="var">st</span>&nbsp;:&nbsp;<span class="id" type="var">state</span>&nbsp;⇒&nbsp;<span class="id" type="var">True</span>&nbsp;∧&nbsp;<span class="id" type="var">bassn</span>&nbsp;(~(<span class="id" type="var">X</span>&nbsp;=&nbsp;0))&nbsp;<span class="id" type="var">st</span>)&nbsp;<span class="nowrap"><span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>-</span></span><span style='letter-spacing:-.2em;'>></span>></span></span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;(<span class="id" type="keyword">fun</span>&nbsp;<span class="id" type="var">st</span>&nbsp;:&nbsp;<span class="id" type="var">state</span>&nbsp;⇒&nbsp;<span class="id" type="var">True</span>&nbsp;∧&nbsp;<span class="id" type="var">st</span>&nbsp;<span class="id" type="var">X</span>&nbsp;≠&nbsp;0))&nbsp;∧<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;((<span class="id" type="keyword">fun</span>&nbsp;<span class="id" type="var">st</span>&nbsp;:&nbsp;<span class="id" type="var">state</span>&nbsp;⇒&nbsp;<span class="id" type="var">True</span>&nbsp;∧&nbsp;¬<span class="id" type="var">bassn</span>&nbsp;(~(<span class="id" type="var">X</span>&nbsp;=&nbsp;0))&nbsp;<span class="id" type="var">st</span>)&nbsp;<span class="nowrap"><span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>-</span></span><span style='letter-spacing:-.2em;'>></span>></span></span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;(<span class="id" type="keyword">fun</span>&nbsp;<span class="id" type="var">st</span>&nbsp;:&nbsp;<span class="id" type="var">state</span>&nbsp;⇒&nbsp;<span class="id" type="var">True</span>&nbsp;∧&nbsp;<span class="id" type="var">st</span>&nbsp;<span class="id" type="var">X</span>&nbsp;=&nbsp;0))&nbsp;∧<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;(<span class="id" type="keyword">fun</span>&nbsp;<span class="id" type="var">st</span>&nbsp;:&nbsp;<span class="id" type="var">state</span>&nbsp;⇒&nbsp;<span class="id" type="var">True</span>&nbsp;∧&nbsp;<span class="id" type="var">st</span>&nbsp;<span class="id" type="var">X</span>&nbsp;≠&nbsp;0)&nbsp;<span class="nowrap"><span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>-</span></span><span style='letter-spacing:-.2em;'>></span>></span></span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;(<span class="id" type="keyword">fun</span>&nbsp;<span class="id" type="var">_</span>&nbsp;:&nbsp;<span class="id" type="var">state</span>&nbsp;⇒&nbsp;<span class="id" type="var">True</span>)&nbsp;[<span class="id" type="var">X</span>&nbsp;<span class="nowrap"><span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>&#x22A2;</span><span style='font-size:90%;'>&gt;</span></span></span></span>&nbsp;<span class="id" type="var">X</span>&nbsp;-&nbsp;1])&nbsp;∧<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;(<span class="id" type="keyword">fun</span>&nbsp;<span class="id" type="var">st</span>&nbsp;:&nbsp;<span class="id" type="var">state</span>&nbsp;⇒&nbsp;<span class="id" type="var">True</span>&nbsp;∧&nbsp;<span class="id" type="var">st</span>&nbsp;<span class="id" type="var">X</span>&nbsp;=&nbsp;0)&nbsp;<span class="nowrap"><span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>-</span></span><span style='letter-spacing:-.2em;'>></span>></span></span>&nbsp;<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;(<span class="id" type="keyword">fun</span>&nbsp;<span class="id" type="var">st</span>&nbsp;:&nbsp;<span class="id" type="var">state</span>&nbsp;⇒&nbsp;<span class="id" type="var">st</span>&nbsp;<span class="id" type="var">X</span>&nbsp;=&nbsp;0)&nbsp;&nbsp;&nbsp;
<div class="paragraph"> </div>

</div>

<div class="paragraph"> </div>

 In principle, we could work with such propositions using just the
    tactics we have so far, but we can make things much smoother with
    a bit of automation.  We first define a custom <span class="inlinecode"><span class="id" type="var">verify</span></span> tactic
    that uses <span class="inlinecode"><span class="id" type="tactic">split</span></span> repeatedly to turn all the conjunctions into
    separate subgoals and then uses <span class="inlinecode"><span class="id" type="tactic">omega</span></span> and <span class="inlinecode"><span class="id" type="tactic">eauto</span></span> (described in
    chapter <a href="https://www.cis.upenn.edu/~bcpierce/sf/lf-current/Auto.html"><span class="inlineref">Auto</span></a> in <i>Logical Foundations</i>) to deal with as many
    of them as possible. 
</div>
<div class="code code-tight">

<span class="id" type="keyword">Tactic Notation</span> "verify" :=<br/>
&nbsp;&nbsp;<span class="id" type="tactic">apply</span> <span class="id" type="var">verification_correct</span>;<br/>
&nbsp;&nbsp;<span class="id" type="tactic">repeat</span> <span class="id" type="tactic">split</span>;<br/>
&nbsp;&nbsp;<span class="id" type="tactic">simpl</span>; <span class="id" type="tactic">unfold</span> <span class="id" type="var">assert_implies</span>;<br/>
&nbsp;&nbsp;<span class="id" type="tactic">unfold</span> <span class="id" type="var">bassn</span> <span class="id" type="keyword">in</span> *; <span class="id" type="tactic">unfold</span> <span class="id" type="var">beval</span> <span class="id" type="keyword">in</span> *; <span class="id" type="tactic">unfold</span> <span class="id" type="var">aeval</span> <span class="id" type="keyword">in</span> *;<br/>
&nbsp;&nbsp;<span class="id" type="tactic">unfold</span> <span class="id" type="var">assn_sub</span>; <span class="id" type="tactic">intros</span>;<br/>
&nbsp;&nbsp;<span class="id" type="tactic">repeat</span> <span class="id" type="tactic">rewrite</span> <span class="id" type="var">t_update_eq</span>;<br/>
&nbsp;&nbsp;<span class="id" type="tactic">repeat</span> (<span class="id" type="tactic">rewrite</span> <span class="id" type="var">t_update_neq</span>; [| (<span class="id" type="tactic">intro</span> <span class="id" type="var">X</span>; <span class="id" type="tactic">inversion</span> <span class="id" type="var">X</span>)]);<br/>
&nbsp;&nbsp;<span class="id" type="tactic">simpl</span> <span class="id" type="keyword">in</span> *;<br/>
&nbsp;&nbsp;<span class="id" type="tactic">repeat</span> <span class="id" type="keyword">match</span> <span class="id" type="var">goal</span> <span class="id" type="keyword">with</span> [<span class="id" type="var">H</span> : <span class="id" type="var">_</span> ∧ <span class="id" type="var">_</span> &#x22A2; <span class="id" type="var">_</span>] ⇒ <span class="id" type="tactic">destruct</span> <span class="id" type="var">H</span> <span class="id" type="keyword">end</span>;<br/>
&nbsp;&nbsp;<span class="id" type="tactic">repeat</span> <span class="id" type="tactic">rewrite</span> <span class="id" type="var">not_true_iff_false</span> <span class="id" type="keyword">in</span> *;<br/>
&nbsp;&nbsp;<span class="id" type="tactic">repeat</span> <span class="id" type="tactic">rewrite</span> <span class="id" type="var">not_false_iff_true</span> <span class="id" type="keyword">in</span> *;<br/>
&nbsp;&nbsp;<span class="id" type="tactic">repeat</span> <span class="id" type="tactic">rewrite</span> <span class="id" type="var">negb_true_iff</span> <span class="id" type="keyword">in</span> *;<br/>
&nbsp;&nbsp;<span class="id" type="tactic">repeat</span> <span class="id" type="tactic">rewrite</span> <span class="id" type="var">negb_false_iff</span> <span class="id" type="keyword">in</span> *;<br/>
&nbsp;&nbsp;<span class="id" type="tactic">repeat</span> <span class="id" type="tactic">rewrite</span> <span class="id" type="var">eqb_eq</span> <span class="id" type="keyword">in</span> *;<br/>
&nbsp;&nbsp;<span class="id" type="tactic">repeat</span> <span class="id" type="tactic">rewrite</span> <span class="id" type="var">eqb_neq</span> <span class="id" type="keyword">in</span> *;<br/>
&nbsp;&nbsp;<span class="id" type="tactic">repeat</span> <span class="id" type="tactic">rewrite</span> <span class="id" type="var">leb_iff</span> <span class="id" type="keyword">in</span> *;<br/>
&nbsp;&nbsp;<span class="id" type="tactic">repeat</span> <span class="id" type="tactic">rewrite</span> <span class="id" type="var">leb_iff_conv</span> <span class="id" type="keyword">in</span> *;<br/>
&nbsp;&nbsp;<span class="id" type="tactic">try</span> <span class="id" type="tactic">subst</span>;<br/>
&nbsp;&nbsp;<span class="id" type="tactic">repeat</span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="keyword">match</span> <span class="id" type="var">goal</span> <span class="id" type="keyword">with</span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;[<span class="id" type="var">st</span> : <span class="id" type="var">state</span> &#x22A2; <span class="id" type="var">_</span>] ⇒<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="keyword">match</span> <span class="id" type="var">goal</span> <span class="id" type="keyword">with</span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;[<span class="id" type="var">H</span> : <span class="id" type="var">st</span> <span class="id" type="var">_</span> = <span class="id" type="var">_</span> &#x22A2; <span class="id" type="var">_</span>] ⇒ <span class="id" type="tactic">rewrite</span> → <span class="id" type="var">H</span> <span class="id" type="keyword">in</span> *; <span class="id" type="tactic">clear</span> <span class="id" type="var">H</span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;| [<span class="id" type="var">H</span> : <span class="id" type="var">_</span> = <span class="id" type="var">st</span> <span class="id" type="var">_</span> &#x22A2; <span class="id" type="var">_</span>] ⇒ <span class="id" type="tactic">rewrite</span> &lt;- <span class="id" type="var">H</span> <span class="id" type="keyword">in</span> *; <span class="id" type="tactic">clear</span> <span class="id" type="var">H</span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="keyword">end</span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="keyword">end</span>;<br/>
&nbsp;&nbsp;<span class="id" type="tactic">try</span> <span class="id" type="tactic">eauto</span>; <span class="id" type="tactic">try</span> <span class="id" type="tactic">omega</span>.<br/>
</div>

<div class="doc">
What's left after <span class="inlinecode"><span class="id" type="var">verify</span></span> does its thing is "just the interesting
    parts" of checking that the decorations are correct. For very
    simple examples, <span class="inlinecode"><span class="id" type="var">verify</span></span> sometimes even immediately solves the
    goal (provided that the annotations are correct!). 
</div>
<div class="code code-tight">

<span class="id" type="keyword">Theorem</span> <span class="id" type="var">dec_while_correct</span> :<br/>
&nbsp;&nbsp;<span class="id" type="var">dec_correct</span> <span class="id" type="var">dec_while</span>.<br/>
<span class="id" type="keyword">Proof</span>. <span class="id" type="var">verify</span>. <span class="id" type="keyword">Qed</span>.<br/>
</div>

<div class="doc">
Another example (formalizing a decorated program we've seen
    before): 
</div>
<div class="code code-tight">

<span class="id" type="keyword">Example</span> <span class="id" type="var">subtract_slowly_dec</span> (<span class="id" type="var">m</span> : <span class="id" type="var">nat</span>) (<span class="id" type="var">p</span> : <span class="id" type="var">nat</span>) : <span class="id" type="var">decorated</span> :=<br/>
&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{ <span class="id" type="keyword">fun</span> <span class="id" type="var">st</span> ⇒ <span class="id" type="var">st</span> <span class="id" type="var">X</span> = <span class="id" type="var">m</span> ∧ <span class="id" type="var">st</span> <span class="id" type="var">Z</span> = <span class="id" type="var">p</span> <span style='letter-spacing:-.4em;'>}</span>} <span class="nowrap"><span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>-</span></span><span style='letter-spacing:-.2em;'>></span>></span></span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{ <span class="id" type="keyword">fun</span> <span class="id" type="var">st</span> ⇒ <span class="id" type="var">st</span> <span class="id" type="var">Z</span> - <span class="id" type="var">st</span> <span class="id" type="var">X</span> = <span class="id" type="var">p</span> - <span class="id" type="var">m</span> <span style='letter-spacing:-.4em;'>}</span>}<br/>
&nbsp;&nbsp;<span class="id" type="var">WHILE</span> ~(<span class="id" type="var">X</span> = 0)<br/>
&nbsp;&nbsp;<span class="id" type="var">DO</span>   <span style='letter-spacing:-.4em;'>{</span>{ <span class="id" type="keyword">fun</span> <span class="id" type="var">st</span> ⇒ <span class="id" type="var">st</span> <span class="id" type="var">Z</span> - <span class="id" type="var">st</span> <span class="id" type="var">X</span> = <span class="id" type="var">p</span> - <span class="id" type="var">m</span> ∧ <span class="id" type="var">st</span> <span class="id" type="var">X</span> ≠ 0 <span style='letter-spacing:-.4em;'>}</span>} <span class="nowrap"><span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>-</span></span><span style='letter-spacing:-.2em;'>></span>></span></span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{ <span class="id" type="keyword">fun</span> <span class="id" type="var">st</span> ⇒ (<span class="id" type="var">st</span> <span class="id" type="var">Z</span> - 1) - (<span class="id" type="var">st</span> <span class="id" type="var">X</span> - 1) = <span class="id" type="var">p</span> - <span class="id" type="var">m</span> <span style='letter-spacing:-.4em;'>}</span>}<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="var">Z</span> <span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>:</span>:</span>=</span> <span class="id" type="var">Z</span> - 1<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{ <span class="id" type="keyword">fun</span> <span class="id" type="var">st</span> ⇒ <span class="id" type="var">st</span> <span class="id" type="var">Z</span> - (<span class="id" type="var">st</span> <span class="id" type="var">X</span> - 1) = <span class="id" type="var">p</span> - <span class="id" type="var">m</span> <span style='letter-spacing:-.4em;'>}</span>} ;;<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="var">X</span> <span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>:</span>:</span>=</span> <span class="id" type="var">X</span> - 1<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{ <span class="id" type="keyword">fun</span> <span class="id" type="var">st</span> ⇒ <span class="id" type="var">st</span> <span class="id" type="var">Z</span> - <span class="id" type="var">st</span> <span class="id" type="var">X</span> = <span class="id" type="var">p</span> - <span class="id" type="var">m</span> <span style='letter-spacing:-.4em;'>}</span>}<br/>
&nbsp;&nbsp;<span class="id" type="var">END</span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{ <span class="id" type="keyword">fun</span> <span class="id" type="var">st</span> ⇒ <span class="id" type="var">st</span> <span class="id" type="var">Z</span> - <span class="id" type="var">st</span> <span class="id" type="var">X</span> = <span class="id" type="var">p</span> - <span class="id" type="var">m</span> ∧ <span class="id" type="var">st</span> <span class="id" type="var">X</span> = 0 <span style='letter-spacing:-.4em;'>}</span>} <span class="nowrap"><span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>-</span></span><span style='letter-spacing:-.2em;'>></span>></span></span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{ <span class="id" type="keyword">fun</span> <span class="id" type="var">st</span> ⇒ <span class="id" type="var">st</span> <span class="id" type="var">Z</span> = <span class="id" type="var">p</span> - <span class="id" type="var">m</span> <span style='letter-spacing:-.4em;'>}</span>}.<br/><hr class='doublespaceincode'/>
<span class="id" type="keyword">Theorem</span> <span class="id" type="var">subtract_slowly_dec_correct</span> : <span style='font-size:120%;'>&forall;</span><span class="id" type="var">m</span> <span class="id" type="var">p</span>,<br/>
&nbsp;&nbsp;<span class="id" type="var">dec_correct</span> (<span class="id" type="var">subtract_slowly_dec</span> <span class="id" type="var">m</span> <span class="id" type="var">p</span>).<br/>
<span class="id" type="keyword">Proof</span>. <span class="id" type="tactic">intros</span> <span class="id" type="var">m</span> <span class="id" type="var">p</span>. <span class="id" type="var">verify</span>. <span class="comment">(*&nbsp;this&nbsp;grinds&nbsp;for&nbsp;a&nbsp;bit!&nbsp;*)</span> <span class="id" type="keyword">Qed</span>.<br/>
</div>

<div class="doc">
<a name="lab112"></a><h2 class="section">Examples</h2>

<div class="paragraph"> </div>

 In this section, we use the automation developed above to verify
    formal decorated programs corresponding to most of the informal
    ones we have seen. 
<div class="paragraph"> </div>

<a name="lab113"></a><h3 class="section">Swapping Using Addition and Subtraction</h3>

</div>
<div class="code code-space">

<br/>
<span class="id" type="keyword">Definition</span> <span class="id" type="var">swap</span> : <span class="id" type="var">com</span> :=<br/>
&nbsp;&nbsp;<span class="id" type="var">X</span> <span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>:</span>:</span>=</span> <span class="id" type="var">X</span> + <span class="id" type="var">Y</span>;;<br/>
&nbsp;&nbsp;<span class="id" type="var">Y</span> <span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>:</span>:</span>=</span> <span class="id" type="var">X</span> - <span class="id" type="var">Y</span>;;<br/>
&nbsp;&nbsp;<span class="id" type="var">X</span> <span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>:</span>:</span>=</span> <span class="id" type="var">X</span> - <span class="id" type="var">Y</span>.<br/><hr class='doublespaceincode'/>
<span class="id" type="keyword">Definition</span> <span class="id" type="var">swap_dec</span> <span class="id" type="var">m</span> <span class="id" type="var">n</span> : <span class="id" type="var">decorated</span> :=<br/>
&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{ <span class="id" type="keyword">fun</span> <span class="id" type="var">st</span> ⇒ <span class="id" type="var">st</span> <span class="id" type="var">X</span> = <span class="id" type="var">m</span> ∧ <span class="id" type="var">st</span> <span class="id" type="var">Y</span> = <span class="id" type="var">n</span><span style='letter-spacing:-.4em;'>}</span>} <span class="nowrap"><span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>-</span></span><span style='letter-spacing:-.2em;'>></span>></span></span><br/>
&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{ <span class="id" type="keyword">fun</span> <span class="id" type="var">st</span> ⇒ (<span class="id" type="var">st</span> <span class="id" type="var">X</span> + <span class="id" type="var">st</span> <span class="id" type="var">Y</span>) - ((<span class="id" type="var">st</span> <span class="id" type="var">X</span> + <span class="id" type="var">st</span> <span class="id" type="var">Y</span>) - <span class="id" type="var">st</span> <span class="id" type="var">Y</span>) = <span class="id" type="var">n</span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;∧ (<span class="id" type="var">st</span> <span class="id" type="var">X</span> + <span class="id" type="var">st</span> <span class="id" type="var">Y</span>) - <span class="id" type="var">st</span> <span class="id" type="var">Y</span> = <span class="id" type="var">m</span> <span style='letter-spacing:-.4em;'>}</span>}<br/>
&nbsp;&nbsp;<span class="id" type="var">X</span> <span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>:</span>:</span>=</span> <span class="id" type="var">X</span> + <span class="id" type="var">Y</span><br/>
&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{ <span class="id" type="keyword">fun</span> <span class="id" type="var">st</span> ⇒ <span class="id" type="var">st</span> <span class="id" type="var">X</span> - (<span class="id" type="var">st</span> <span class="id" type="var">X</span> - <span class="id" type="var">st</span> <span class="id" type="var">Y</span>) = <span class="id" type="var">n</span> ∧ <span class="id" type="var">st</span> <span class="id" type="var">X</span> - <span class="id" type="var">st</span> <span class="id" type="var">Y</span> = <span class="id" type="var">m</span> <span style='letter-spacing:-.4em;'>}</span>};;<br/>
&nbsp;&nbsp;<span class="id" type="var">Y</span> <span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>:</span>:</span>=</span> <span class="id" type="var">X</span> - <span class="id" type="var">Y</span><br/>
&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{ <span class="id" type="keyword">fun</span> <span class="id" type="var">st</span> ⇒ <span class="id" type="var">st</span> <span class="id" type="var">X</span> - <span class="id" type="var">st</span> <span class="id" type="var">Y</span> = <span class="id" type="var">n</span> ∧ <span class="id" type="var">st</span> <span class="id" type="var">Y</span> = <span class="id" type="var">m</span> <span style='letter-spacing:-.4em;'>}</span>};;<br/>
&nbsp;&nbsp;<span class="id" type="var">X</span> <span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>:</span>:</span>=</span> <span class="id" type="var">X</span> - <span class="id" type="var">Y</span><br/>
&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{ <span class="id" type="keyword">fun</span> <span class="id" type="var">st</span> ⇒ <span class="id" type="var">st</span> <span class="id" type="var">X</span> = <span class="id" type="var">n</span> ∧ <span class="id" type="var">st</span> <span class="id" type="var">Y</span> = <span class="id" type="var">m</span><span style='letter-spacing:-.4em;'>}</span>}.<br/><hr class='doublespaceincode'/>
<span class="id" type="keyword">Theorem</span> <span class="id" type="var">swap_correct</span> : <span style='font-size:120%;'>&forall;</span><span class="id" type="var">m</span> <span class="id" type="var">n</span>,<br/>
&nbsp;&nbsp;<span class="id" type="var">dec_correct</span> (<span class="id" type="var">swap_dec</span> <span class="id" type="var">m</span> <span class="id" type="var">n</span>).<br/>
<span class="id" type="keyword">Proof</span>. <span class="id" type="tactic">intros</span>; <span class="id" type="var">verify</span>. <span class="id" type="keyword">Qed</span>.<br/>
</div>

<div class="doc">
<a name="lab114"></a><h3 class="section">Simple Conditionals</h3>

</div>
<div class="code code-space">

<br/>
<span class="id" type="keyword">Definition</span> <span class="id" type="var">if_minus_plus_com</span> :=<br/>
&nbsp;&nbsp;(<span class="id" type="var">TEST</span> <span class="id" type="var">X</span> ≤ <span class="id" type="var">Y</span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="var">THEN</span> <span class="id" type="var">Z</span> <span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>:</span>:</span>=</span> <span class="id" type="var">Y</span> - <span class="id" type="var">X</span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="var">ELSE</span> <span class="id" type="var">Y</span> <span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>:</span>:</span>=</span> <span class="id" type="var">X</span> + <span class="id" type="var">Z</span><br/>
&nbsp;&nbsp;<span class="id" type="var">FI</span>)%<span class="id" type="var">imp</span>.<br/><hr class='doublespaceincode'/>
<span class="id" type="keyword">Definition</span> <span class="id" type="var">if_minus_plus_dec</span> :=<br/>
&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{<span class="id" type="keyword">fun</span> <span class="id" type="var">st</span> ⇒ <span class="id" type="var">True</span><span style='letter-spacing:-.4em;'>}</span>}<br/>
&nbsp;&nbsp;<span class="id" type="var">TEST</span> <span class="id" type="var">X</span> ≤ <span class="id" type="var">Y</span>  <span class="id" type="var">THEN</span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{ <span class="id" type="keyword">fun</span> <span class="id" type="var">st</span> ⇒ <span class="id" type="var">True</span> ∧ <span class="id" type="var">st</span> <span class="id" type="var">X</span> ≤ <span class="id" type="var">st</span> <span class="id" type="var">Y</span> <span style='letter-spacing:-.4em;'>}</span>} <span class="nowrap"><span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>-</span></span><span style='letter-spacing:-.2em;'>></span>></span></span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{ <span class="id" type="keyword">fun</span> <span class="id" type="var">st</span> ⇒ <span class="id" type="var">st</span> <span class="id" type="var">Y</span> = <span class="id" type="var">st</span> <span class="id" type="var">X</span> + (<span class="id" type="var">st</span> <span class="id" type="var">Y</span> - <span class="id" type="var">st</span> <span class="id" type="var">X</span>) <span style='letter-spacing:-.4em;'>}</span>}<br/>
&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="var">Z</span> <span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>:</span>:</span>=</span> <span class="id" type="var">Y</span> - <span class="id" type="var">X</span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{ <span class="id" type="keyword">fun</span> <span class="id" type="var">st</span> ⇒ <span class="id" type="var">st</span> <span class="id" type="var">Y</span> = <span class="id" type="var">st</span> <span class="id" type="var">X</span> + <span class="id" type="var">st</span> <span class="id" type="var">Z</span> <span style='letter-spacing:-.4em;'>}</span>}<br/>
&nbsp;&nbsp;<span class="id" type="var">ELSE</span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{ <span class="id" type="keyword">fun</span> <span class="id" type="var">st</span> ⇒ <span class="id" type="var">True</span> ∧ ~(<span class="id" type="var">st</span> <span class="id" type="var">X</span> ≤ <span class="id" type="var">st</span> <span class="id" type="var">Y</span>) <span style='letter-spacing:-.4em;'>}</span>} <span class="nowrap"><span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>-</span></span><span style='letter-spacing:-.2em;'>></span>></span></span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{ <span class="id" type="keyword">fun</span> <span class="id" type="var">st</span> ⇒ <span class="id" type="var">st</span> <span class="id" type="var">X</span> + <span class="id" type="var">st</span> <span class="id" type="var">Z</span> = <span class="id" type="var">st</span> <span class="id" type="var">X</span> + <span class="id" type="var">st</span> <span class="id" type="var">Z</span> <span style='letter-spacing:-.4em;'>}</span>}<br/>
&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="var">Y</span> <span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>:</span>:</span>=</span> <span class="id" type="var">X</span> + <span class="id" type="var">Z</span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{ <span class="id" type="keyword">fun</span> <span class="id" type="var">st</span> ⇒ <span class="id" type="var">st</span> <span class="id" type="var">Y</span> = <span class="id" type="var">st</span> <span class="id" type="var">X</span> + <span class="id" type="var">st</span> <span class="id" type="var">Z</span> <span style='letter-spacing:-.4em;'>}</span>}<br/>
&nbsp;&nbsp;<span class="id" type="var">FI</span><br/>
&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{<span class="id" type="keyword">fun</span> <span class="id" type="var">st</span> ⇒ <span class="id" type="var">st</span> <span class="id" type="var">Y</span> = <span class="id" type="var">st</span> <span class="id" type="var">X</span> + <span class="id" type="var">st</span> <span class="id" type="var">Z</span><span style='letter-spacing:-.4em;'>}</span>}.<br/><hr class='doublespaceincode'/>
<span class="id" type="keyword">Theorem</span> <span class="id" type="var">if_minus_plus_correct</span> :<br/>
&nbsp;&nbsp;<span class="id" type="var">dec_correct</span> <span class="id" type="var">if_minus_plus_dec</span>.<br/>
<span class="id" type="keyword">Proof</span>. <span class="id" type="var">verify</span>. <span class="id" type="keyword">Qed</span>.<br/><hr class='doublespaceincode'/>
<span class="id" type="keyword">Definition</span> <span class="id" type="var">if_minus_dec</span> :=<br/>
&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{<span class="id" type="keyword">fun</span> <span class="id" type="var">st</span> ⇒ <span class="id" type="var">True</span><span style='letter-spacing:-.4em;'>}</span>}<br/>
&nbsp;&nbsp;<span class="id" type="var">TEST</span> <span class="id" type="var">X</span> ≤ <span class="id" type="var">Y</span> <span class="id" type="var">THEN</span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{<span class="id" type="keyword">fun</span> <span class="id" type="var">st</span> ⇒ <span class="id" type="var">True</span> ∧ <span class="id" type="var">st</span> <span class="id" type="var">X</span> ≤ <span class="id" type="var">st</span> <span class="id" type="var">Y</span> <span style='letter-spacing:-.4em;'>}</span>} <span class="nowrap"><span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>-</span></span><span style='letter-spacing:-.2em;'>></span>></span></span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{<span class="id" type="keyword">fun</span> <span class="id" type="var">st</span> ⇒ (<span class="id" type="var">st</span> <span class="id" type="var">Y</span> - <span class="id" type="var">st</span> <span class="id" type="var">X</span>) + <span class="id" type="var">st</span> <span class="id" type="var">X</span> = <span class="id" type="var">st</span> <span class="id" type="var">Y</span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;∨ (<span class="id" type="var">st</span> <span class="id" type="var">Y</span> - <span class="id" type="var">st</span> <span class="id" type="var">X</span>) + <span class="id" type="var">st</span> <span class="id" type="var">Y</span> = <span class="id" type="var">st</span> <span class="id" type="var">X</span><span style='letter-spacing:-.4em;'>}</span>}<br/>
&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="var">Z</span> <span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>:</span>:</span>=</span> <span class="id" type="var">Y</span> - <span class="id" type="var">X</span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{<span class="id" type="keyword">fun</span> <span class="id" type="var">st</span> ⇒ <span class="id" type="var">st</span> <span class="id" type="var">Z</span> + <span class="id" type="var">st</span> <span class="id" type="var">X</span> = <span class="id" type="var">st</span> <span class="id" type="var">Y</span> ∨ <span class="id" type="var">st</span> <span class="id" type="var">Z</span> + <span class="id" type="var">st</span> <span class="id" type="var">Y</span> = <span class="id" type="var">st</span> <span class="id" type="var">X</span><span style='letter-spacing:-.4em;'>}</span>}<br/>
&nbsp;&nbsp;<span class="id" type="var">ELSE</span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{<span class="id" type="keyword">fun</span> <span class="id" type="var">st</span> ⇒ <span class="id" type="var">True</span> ∧ ~(<span class="id" type="var">st</span> <span class="id" type="var">X</span> ≤ <span class="id" type="var">st</span> <span class="id" type="var">Y</span>) <span style='letter-spacing:-.4em;'>}</span>} <span class="nowrap"><span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>-</span></span><span style='letter-spacing:-.2em;'>></span>></span></span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{<span class="id" type="keyword">fun</span> <span class="id" type="var">st</span> ⇒ (<span class="id" type="var">st</span> <span class="id" type="var">X</span> - <span class="id" type="var">st</span> <span class="id" type="var">Y</span>) + <span class="id" type="var">st</span> <span class="id" type="var">X</span> = <span class="id" type="var">st</span> <span class="id" type="var">Y</span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;∨ (<span class="id" type="var">st</span> <span class="id" type="var">X</span> - <span class="id" type="var">st</span> <span class="id" type="var">Y</span>) + <span class="id" type="var">st</span> <span class="id" type="var">Y</span> = <span class="id" type="var">st</span> <span class="id" type="var">X</span><span style='letter-spacing:-.4em;'>}</span>}<br/>
&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="var">Z</span> <span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>:</span>:</span>=</span> <span class="id" type="var">X</span> - <span class="id" type="var">Y</span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{<span class="id" type="keyword">fun</span> <span class="id" type="var">st</span> ⇒ <span class="id" type="var">st</span> <span class="id" type="var">Z</span> + <span class="id" type="var">st</span> <span class="id" type="var">X</span> = <span class="id" type="var">st</span> <span class="id" type="var">Y</span> ∨ <span class="id" type="var">st</span> <span class="id" type="var">Z</span> + <span class="id" type="var">st</span> <span class="id" type="var">Y</span> = <span class="id" type="var">st</span> <span class="id" type="var">X</span><span style='letter-spacing:-.4em;'>}</span>}<br/>
&nbsp;&nbsp;<span class="id" type="var">FI</span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{<span class="id" type="keyword">fun</span> <span class="id" type="var">st</span> ⇒ <span class="id" type="var">st</span> <span class="id" type="var">Z</span> + <span class="id" type="var">st</span> <span class="id" type="var">X</span> = <span class="id" type="var">st</span> <span class="id" type="var">Y</span> ∨ <span class="id" type="var">st</span> <span class="id" type="var">Z</span> + <span class="id" type="var">st</span> <span class="id" type="var">Y</span> = <span class="id" type="var">st</span> <span class="id" type="var">X</span><span style='letter-spacing:-.4em;'>}</span>}.<br/><hr class='doublespaceincode'/>
<span class="id" type="keyword">Theorem</span> <span class="id" type="var">if_minus_correct</span> :<br/>
&nbsp;&nbsp;<span class="id" type="var">dec_correct</span> <span class="id" type="var">if_minus_dec</span>.<br/>
<span class="id" type="keyword">Proof</span>. <span class="id" type="var">verify</span>. <span class="id" type="keyword">Qed</span>.<br/>
</div>

<div class="doc">
<a name="lab115"></a><h3 class="section">Division</h3>

</div>
<div class="code code-space">

<br/>
<span class="id" type="keyword">Definition</span> <span class="id" type="var">div_mod_dec</span> (<span class="id" type="var">a</span> <span class="id" type="var">b</span> : <span class="id" type="var">nat</span>) : <span class="id" type="var">decorated</span> :=<br/>
&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{ <span class="id" type="keyword">fun</span> <span class="id" type="var">st</span> ⇒ <span class="id" type="var">True</span> <span style='letter-spacing:-.4em;'>}</span>} <span class="nowrap"><span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>-</span></span><span style='letter-spacing:-.2em;'>></span>></span></span><br/>
&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{ <span class="id" type="keyword">fun</span> <span class="id" type="var">st</span> ⇒ <span class="id" type="var">b</span> * 0 + <span class="id" type="var">a</span> = <span class="id" type="var">a</span> <span style='letter-spacing:-.4em;'>}</span>}<br/>
&nbsp;&nbsp;<span class="id" type="var">X</span> <span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>:</span>:</span>=</span> <span class="id" type="var">a</span><br/>
&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{ <span class="id" type="keyword">fun</span> <span class="id" type="var">st</span> ⇒ <span class="id" type="var">b</span> * 0 + <span class="id" type="var">st</span> <span class="id" type="var">X</span> = <span class="id" type="var">a</span> <span style='letter-spacing:-.4em;'>}</span>};;<br/>
&nbsp;&nbsp;<span class="id" type="var">Y</span> <span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>:</span>:</span>=</span> 0<br/>
&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{ <span class="id" type="keyword">fun</span> <span class="id" type="var">st</span> ⇒ <span class="id" type="var">b</span> * <span class="id" type="var">st</span> <span class="id" type="var">Y</span> + <span class="id" type="var">st</span> <span class="id" type="var">X</span> = <span class="id" type="var">a</span> <span style='letter-spacing:-.4em;'>}</span>};;<br/>
&nbsp;&nbsp;<span class="id" type="var">WHILE</span> <span class="id" type="var">b</span> ≤ <span class="id" type="var">X</span> <span class="id" type="var">DO</span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{ <span class="id" type="keyword">fun</span> <span class="id" type="var">st</span> ⇒ <span class="id" type="var">b</span> * <span class="id" type="var">st</span> <span class="id" type="var">Y</span> + <span class="id" type="var">st</span> <span class="id" type="var">X</span> = <span class="id" type="var">a</span> ∧ <span class="id" type="var">b</span> ≤ <span class="id" type="var">st</span> <span class="id" type="var">X</span> <span style='letter-spacing:-.4em;'>}</span>} <span class="nowrap"><span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>-</span></span><span style='letter-spacing:-.2em;'>></span>></span></span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{ <span class="id" type="keyword">fun</span> <span class="id" type="var">st</span> ⇒ <span class="id" type="var">b</span> * (<span class="id" type="var">st</span> <span class="id" type="var">Y</span> + 1) + (<span class="id" type="var">st</span> <span class="id" type="var">X</span> - <span class="id" type="var">b</span>) = <span class="id" type="var">a</span> <span style='letter-spacing:-.4em;'>}</span>}<br/>
&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="var">X</span> <span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>:</span>:</span>=</span> <span class="id" type="var">X</span> - <span class="id" type="var">b</span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{ <span class="id" type="keyword">fun</span> <span class="id" type="var">st</span> ⇒ <span class="id" type="var">b</span> * (<span class="id" type="var">st</span> <span class="id" type="var">Y</span> + 1) + <span class="id" type="var">st</span> <span class="id" type="var">X</span> = <span class="id" type="var">a</span> <span style='letter-spacing:-.4em;'>}</span>};;<br/>
&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="var">Y</span> <span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>:</span>:</span>=</span> <span class="id" type="var">Y</span> + 1<br/>
&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{ <span class="id" type="keyword">fun</span> <span class="id" type="var">st</span> ⇒ <span class="id" type="var">b</span> * <span class="id" type="var">st</span> <span class="id" type="var">Y</span> + <span class="id" type="var">st</span> <span class="id" type="var">X</span> = <span class="id" type="var">a</span> <span style='letter-spacing:-.4em;'>}</span>}<br/>
&nbsp;&nbsp;<span class="id" type="var">END</span><br/>
&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{ <span class="id" type="keyword">fun</span> <span class="id" type="var">st</span> ⇒ <span class="id" type="var">b</span> * <span class="id" type="var">st</span> <span class="id" type="var">Y</span> + <span class="id" type="var">st</span> <span class="id" type="var">X</span> = <span class="id" type="var">a</span> ∧ ~(<span class="id" type="var">b</span> ≤ <span class="id" type="var">st</span> <span class="id" type="var">X</span>) <span style='letter-spacing:-.4em;'>}</span>} <span class="nowrap"><span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>-</span></span><span style='letter-spacing:-.2em;'>></span>></span></span><br/>
&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{ <span class="id" type="keyword">fun</span> <span class="id" type="var">st</span> ⇒ <span class="id" type="var">b</span> * <span class="id" type="var">st</span> <span class="id" type="var">Y</span> + <span class="id" type="var">st</span> <span class="id" type="var">X</span> = <span class="id" type="var">a</span> ∧ (<span class="id" type="var">st</span> <span class="id" type="var">X</span> &lt; <span class="id" type="var">b</span>) <span style='letter-spacing:-.4em;'>}</span>}.<br/><hr class='doublespaceincode'/>
<span class="id" type="keyword">Theorem</span> <span class="id" type="var">div_mod_dec_correct</span> : <span style='font-size:120%;'>&forall;</span><span class="id" type="var">a</span> <span class="id" type="var">b</span>,<br/>
&nbsp;&nbsp;<span class="id" type="var">dec_correct</span> (<span class="id" type="var">div_mod_dec</span> <span class="id" type="var">a</span> <span class="id" type="var">b</span>).<br/>
<span class="id" type="keyword">Proof</span>. <span class="id" type="tactic">intros</span> <span class="id" type="var">a</span> <span class="id" type="var">b</span>. <span class="id" type="var">verify</span>.<br/>
&nbsp;&nbsp;<span class="id" type="tactic">rewrite</span> <span class="id" type="var">mult_plus_distr_l</span>. <span class="id" type="tactic">omega</span>.<br/>
<span class="id" type="keyword">Qed</span>.<br/>
</div>

<div class="doc">
<a name="lab116"></a><h3 class="section">Parity</h3>

</div>
<div class="code code-space">

<br/>
<span class="id" type="keyword">Definition</span> <span class="id" type="var">find_parity</span> : <span class="id" type="var">com</span> :=<br/>
&nbsp;&nbsp;<span class="id" type="var">WHILE</span> 2 ≤ <span class="id" type="var">X</span> <span class="id" type="var">DO</span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="var">X</span> <span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>:</span>:</span>=</span> <span class="id" type="var">X</span> - 2<br/>
&nbsp;&nbsp;<span class="id" type="var">END</span>.<br/>
</div>

<div class="doc">
There are actually several ways to phrase the loop invariant for
    this program.  Here is one natural one, which leads to a rather
    long proof: 
</div>
<div class="code code-tight">

<span class="id" type="keyword">Inductive</span> <span class="id" type="var">ev</span> : <span class="id" type="var">nat</span> → <span class="id" type="keyword">Prop</span> :=<br/>
&nbsp;&nbsp;| <span class="id" type="var">ev_0</span> : <span class="id" type="var">ev</span> <span class="id" type="var">O</span><br/>
&nbsp;&nbsp;| <span class="id" type="var">ev_SS</span> : <span style='font-size:120%;'>&forall;</span><span class="id" type="var">n</span> : <span class="id" type="var">nat</span>, <span class="id" type="var">ev</span> <span class="id" type="var">n</span> → <span class="id" type="var">ev</span> (<span class="id" type="var">S</span> (<span class="id" type="var">S</span> <span class="id" type="var">n</span>)).<br/><hr class='doublespaceincode'/>
<span class="id" type="keyword">Definition</span> <span class="id" type="var">find_parity_dec</span> <span class="id" type="var">m</span> : <span class="id" type="var">decorated</span> :=<br/>
&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{ <span class="id" type="keyword">fun</span> <span class="id" type="var">st</span> ⇒ <span class="id" type="var">st</span> <span class="id" type="var">X</span> = <span class="id" type="var">m</span><span style='letter-spacing:-.4em;'>}</span>} <span class="nowrap"><span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>-</span></span><span style='letter-spacing:-.2em;'>></span>></span></span><br/>
&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{ <span class="id" type="keyword">fun</span> <span class="id" type="var">st</span> ⇒ <span class="id" type="var">st</span> <span class="id" type="var">X</span> ≤ <span class="id" type="var">m</span> ∧ <span class="id" type="var">ev</span> (<span class="id" type="var">m</span> - <span class="id" type="var">st</span> <span class="id" type="var">X</span>) <span style='letter-spacing:-.4em;'>}</span>}<br/>
&nbsp;&nbsp;<span class="id" type="var">WHILE</span> 2 ≤ <span class="id" type="var">X</span> <span class="id" type="var">DO</span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{ <span class="id" type="keyword">fun</span> <span class="id" type="var">st</span> ⇒ (<span class="id" type="var">st</span> <span class="id" type="var">X</span> ≤ <span class="id" type="var">m</span> ∧ <span class="id" type="var">ev</span> (<span class="id" type="var">m</span> - <span class="id" type="var">st</span> <span class="id" type="var">X</span>)) ∧ 2 ≤ <span class="id" type="var">st</span> <span class="id" type="var">X</span> <span style='letter-spacing:-.4em;'>}</span>} <span class="nowrap"><span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>-</span></span><span style='letter-spacing:-.2em;'>></span>></span></span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{ <span class="id" type="keyword">fun</span> <span class="id" type="var">st</span> ⇒ <span class="id" type="var">st</span> <span class="id" type="var">X</span> - 2 ≤ <span class="id" type="var">m</span> ∧ (<span class="id" type="var">ev</span> (<span class="id" type="var">m</span> - (<span class="id" type="var">st</span> <span class="id" type="var">X</span> - 2))) <span style='letter-spacing:-.4em;'>}</span>}<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="var">X</span> <span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>:</span>:</span>=</span> <span class="id" type="var">X</span> - 2<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{ <span class="id" type="keyword">fun</span> <span class="id" type="var">st</span> ⇒ <span class="id" type="var">st</span> <span class="id" type="var">X</span> ≤ <span class="id" type="var">m</span> ∧ <span class="id" type="var">ev</span> (<span class="id" type="var">m</span> - <span class="id" type="var">st</span> <span class="id" type="var">X</span>) <span style='letter-spacing:-.4em;'>}</span>}<br/>
&nbsp;&nbsp;<span class="id" type="var">END</span><br/>
&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{ <span class="id" type="keyword">fun</span> <span class="id" type="var">st</span> ⇒ (<span class="id" type="var">st</span> <span class="id" type="var">X</span> ≤ <span class="id" type="var">m</span> ∧ <span class="id" type="var">ev</span> (<span class="id" type="var">m</span> - <span class="id" type="var">st</span> <span class="id" type="var">X</span>)) ∧ <span class="id" type="var">st</span> <span class="id" type="var">X</span> &lt; 2 <span style='letter-spacing:-.4em;'>}</span>} <span class="nowrap"><span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>-</span></span><span style='letter-spacing:-.2em;'>></span>></span></span><br/>
&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{ <span class="id" type="keyword">fun</span> <span class="id" type="var">st</span> ⇒ <span class="id" type="var">st</span> <span class="id" type="var">X</span>=0 ↔ <span class="id" type="var">ev</span> <span class="id" type="var">m</span> <span style='letter-spacing:-.4em;'>}</span>}.<br/><hr class='doublespaceincode'/>
<span class="id" type="keyword">Lemma</span> <span class="id" type="var">l<sub>1</sub></span> : <span style='font-size:120%;'>&forall;</span><span class="id" type="var">m</span> <span class="id" type="var">n</span> <span class="id" type="var">p</span>,<br/>
&nbsp;&nbsp;<span class="id" type="var">p</span> ≤ <span class="id" type="var">n</span> →<br/>
&nbsp;&nbsp;<span class="id" type="var">n</span> ≤ <span class="id" type="var">m</span> →<br/>
&nbsp;&nbsp;<span class="id" type="var">m</span> - (<span class="id" type="var">n</span> - <span class="id" type="var">p</span>) = <span class="id" type="var">m</span> - <span class="id" type="var">n</span> + <span class="id" type="var">p</span>.<br/>
<span class="id" type="keyword">Proof</span>. <span class="id" type="tactic">intros</span>. <span class="id" type="tactic">omega</span>. <span class="id" type="keyword">Qed</span>.<br/><hr class='doublespaceincode'/>
<span class="id" type="keyword">Lemma</span> <span class="id" type="var">l<sub>2</sub></span> : <span style='font-size:120%;'>&forall;</span><span class="id" type="var">m</span>,<br/>
&nbsp;&nbsp;<span class="id" type="var">ev</span> <span class="id" type="var">m</span> →<br/>
&nbsp;&nbsp;<span class="id" type="var">ev</span> (<span class="id" type="var">m</span> + 2).<br/>
<span class="id" type="keyword">Proof</span>. <span class="id" type="tactic">intros</span>. <span class="id" type="tactic">rewrite</span> <span class="id" type="var">plus_comm</span>. <span class="id" type="tactic">simpl</span>. <span class="id" type="var">constructor</span>. <span class="id" type="tactic">assumption</span>. <span class="id" type="keyword">Qed</span>.<br/><hr class='doublespaceincode'/>
<span class="id" type="keyword">Lemma</span> <span class="id" type="var">l<sub>3</sub>'</span> : <span style='font-size:120%;'>&forall;</span><span class="id" type="var">m</span>,<br/>
&nbsp;&nbsp;<span class="id" type="var">ev</span> <span class="id" type="var">m</span> →<br/>
&nbsp;&nbsp;¬<span class="id" type="var">ev</span> (<span class="id" type="var">S</span> <span class="id" type="var">m</span>).<br/>
<span class="id" type="keyword">Proof</span>. <span class="id" type="tactic">induction</span> <span class="id" type="var">m</span>; <span class="id" type="tactic">intros</span> <span class="id" type="var">H<sub>1</sub></span> <span class="id" type="var">H<sub>2</sub></span>. <span class="id" type="tactic">inversion</span> <span class="id" type="var">H<sub>2</sub></span>. <span class="id" type="tactic">apply</span> <span class="id" type="var">IHm</span>.<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="tactic">inversion</span> <span class="id" type="var">H<sub>2</sub></span>; <span class="id" type="tactic">subst</span>; <span class="id" type="tactic">assumption</span>. <span class="id" type="tactic">assumption</span>. <span class="id" type="keyword">Qed</span>.<br/><hr class='doublespaceincode'/>
<span class="id" type="keyword">Lemma</span> <span class="id" type="var">l<sub>3</sub></span> : <span style='font-size:120%;'>&forall;</span><span class="id" type="var">m</span>,<br/>
&nbsp;&nbsp;1 ≤ <span class="id" type="var">m</span> →<br/>
&nbsp;&nbsp;<span class="id" type="var">ev</span> <span class="id" type="var">m</span> →<br/>
&nbsp;&nbsp;<span class="id" type="var">ev</span> (<span class="id" type="var">m</span> - 1) →<br/>
&nbsp;&nbsp;<span class="id" type="var">False</span>.<br/>
<span class="id" type="keyword">Proof</span>. <span class="id" type="tactic">intros</span>. <span class="id" type="tactic">apply</span> <span class="id" type="var">l<sub>2</sub></span> <span class="id" type="keyword">in</span> <span class="id" type="var">H<sub>1</sub></span>.<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="tactic">assert</span> (<span class="id" type="var">G</span> : <span class="id" type="var">m</span> - 1 + 2 = <span class="id" type="var">S</span> <span class="id" type="var">m</span>). <span class="id" type="tactic">clear</span> <span class="id" type="var">H<sub>0</sub></span> <span class="id" type="var">H<sub>1</sub></span>. <span class="id" type="tactic">omega</span>.<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="tactic">rewrite</span> <span class="id" type="var">G</span> <span class="id" type="keyword">in</span> <span class="id" type="var">H<sub>1</sub></span>. <span class="id" type="tactic">apply</span> <span class="id" type="var">l<sub>3</sub>'</span> <span class="id" type="keyword">in</span> <span class="id" type="var">H<sub>0</sub></span>. <span class="id" type="tactic">apply</span> <span class="id" type="var">H<sub>0</sub></span>. <span class="id" type="tactic">assumption</span>. <span class="id" type="keyword">Qed</span>.<br/><hr class='doublespaceincode'/>
<span class="id" type="keyword">Theorem</span> <span class="id" type="var">find_parity_correct</span> : <span style='font-size:120%;'>&forall;</span><span class="id" type="var">m</span>,<br/>
&nbsp;&nbsp;<span class="id" type="var">dec_correct</span> (<span class="id" type="var">find_parity_dec</span> <span class="id" type="var">m</span>).<br/>
<span class="id" type="keyword">Proof</span>.<br/>
&nbsp;&nbsp;<span class="id" type="tactic">intro</span> <span class="id" type="var">m</span>. <span class="id" type="var">verify</span>;<br/>
&nbsp;&nbsp;&nbsp;&nbsp;<span class="comment">(*&nbsp;simplification&nbsp;too&nbsp;aggressive&nbsp;...&nbsp;reverting&nbsp;a&nbsp;bit&nbsp;*)</span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="var">fold</span> (2 &lt;=? (<span class="id" type="var">st</span> <span class="id" type="var">X</span>)) <span class="id" type="keyword">in</span> *;<br/>
&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="tactic">try</span> <span class="id" type="tactic">rewrite</span> <span class="id" type="var">leb_iff</span> <span class="id" type="keyword">in</span> *;<br/>
&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="tactic">try</span> <span class="id" type="tactic">rewrite</span> <span class="id" type="var">leb_iff_conv</span> <span class="id" type="keyword">in</span> *; <span class="id" type="tactic">eauto</span>; <span class="id" type="tactic">try</span> <span class="id" type="tactic">omega</span>.<br/>
&nbsp;&nbsp;&nbsp;&nbsp;- <span class="comment">(*&nbsp;invariant&nbsp;holds&nbsp;initially&nbsp;*)</span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="tactic">rewrite</span> <span class="id" type="var">minus_diag</span>. <span class="id" type="var">constructor</span>.<br/>
&nbsp;&nbsp;&nbsp;&nbsp;- <span class="comment">(*&nbsp;invariant&nbsp;preserved&nbsp;*)</span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="tactic">rewrite</span> <span class="id" type="var">l<sub>1</sub></span>; <span class="id" type="tactic">try</span> <span class="id" type="tactic">assumption</span>.<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="tactic">apply</span> <span class="id" type="var">l<sub>2</sub></span>; <span class="id" type="tactic">assumption</span>.<br/>
&nbsp;&nbsp;&nbsp;&nbsp;- <span class="comment">(*&nbsp;invariant&nbsp;strong&nbsp;enough&nbsp;to&nbsp;imply&nbsp;conclusion<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;(<span class="nowrap"><span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>-</span></span>&gt;</span></span>&nbsp;direction)&nbsp;*)</span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="tactic">rewrite</span> &lt;- <span class="id" type="var">minus_n_O</span> <span class="id" type="keyword">in</span> <span class="id" type="var">H<sub>2</sub></span>. <span class="id" type="tactic">assumption</span>.<br/>
&nbsp;&nbsp;&nbsp;&nbsp;- <span class="comment">(*&nbsp;invariant&nbsp;strong&nbsp;enough&nbsp;to&nbsp;imply&nbsp;conclusion<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;(&lt;-&nbsp;direction)&nbsp;*)</span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="tactic">destruct</span> (<span class="id" type="var">st</span> <span class="id" type="var">X</span>) <span class="id" type="keyword">as</span> [| [| <span class="id" type="var">n</span>]].<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="comment">(*&nbsp;by&nbsp;H<sub>1</sub>&nbsp;X&nbsp;can&nbsp;only&nbsp;be&nbsp;0&nbsp;or&nbsp;1&nbsp;*)</span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;+ <span class="comment">(*&nbsp;st&nbsp;X&nbsp;=&nbsp;0&nbsp;*)</span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="tactic">reflexivity</span>.<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;+ <span class="comment">(*&nbsp;st&nbsp;X&nbsp;=&nbsp;1&nbsp;*)</span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="tactic">apply</span> <span class="id" type="var">l<sub>3</sub></span> <span class="id" type="keyword">in</span> <span class="id" type="var">H</span>; <span class="id" type="tactic">try</span> <span class="id" type="tactic">assumption</span>. <span class="id" type="tactic">inversion</span> <span class="id" type="var">H</span>.<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;+ <span class="comment">(*&nbsp;st&nbsp;X&nbsp;=&nbsp;2&nbsp;*)</span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="tactic">clear</span> <span class="id" type="var">H<sub>0</sub></span> <span class="id" type="var">H<sub>2</sub></span>. <span class="comment">(*&nbsp;omega&nbsp;confused&nbsp;otherwise&nbsp;*)</span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="tactic">omega</span>.<br/>
<span class="id" type="keyword">Qed</span>.<br/>
</div>

<div class="doc">
Here is a more intuitive way of writing the invariant: 
</div>
<div class="code code-tight">

<span class="id" type="keyword">Definition</span> <span class="id" type="var">find_parity_dec'</span> <span class="id" type="var">m</span> : <span class="id" type="var">decorated</span> :=<br/>
&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{ <span class="id" type="keyword">fun</span> <span class="id" type="var">st</span> ⇒ <span class="id" type="var">st</span> <span class="id" type="var">X</span> = <span class="id" type="var">m</span><span style='letter-spacing:-.4em;'>}</span>} <span class="nowrap"><span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>-</span></span><span style='letter-spacing:-.2em;'>></span>></span></span><br/>
&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{ <span class="id" type="keyword">fun</span> <span class="id" type="var">st</span> ⇒ <span class="id" type="var">ev</span> (<span class="id" type="var">st</span> <span class="id" type="var">X</span>) ↔ <span class="id" type="var">ev</span> <span class="id" type="var">m</span> <span style='letter-spacing:-.4em;'>}</span>}<br/>
&nbsp;<span class="id" type="var">WHILE</span> 2 ≤ <span class="id" type="var">X</span> <span class="id" type="var">DO</span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{ <span class="id" type="keyword">fun</span> <span class="id" type="var">st</span> ⇒ (<span class="id" type="var">ev</span> (<span class="id" type="var">st</span> <span class="id" type="var">X</span>) ↔ <span class="id" type="var">ev</span> <span class="id" type="var">m</span>) ∧ 2 ≤ <span class="id" type="var">st</span> <span class="id" type="var">X</span> <span style='letter-spacing:-.4em;'>}</span>} <span class="nowrap"><span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>-</span></span><span style='letter-spacing:-.2em;'>></span>></span></span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{ <span class="id" type="keyword">fun</span> <span class="id" type="var">st</span> ⇒ (<span class="id" type="var">ev</span> (<span class="id" type="var">st</span> <span class="id" type="var">X</span> - 2) ↔ <span class="id" type="var">ev</span> <span class="id" type="var">m</span>) <span style='letter-spacing:-.4em;'>}</span>}<br/>
&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="var">X</span> <span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>:</span>:</span>=</span> <span class="id" type="var">X</span> - 2<br/>
&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{ <span class="id" type="keyword">fun</span> <span class="id" type="var">st</span> ⇒ (<span class="id" type="var">ev</span> (<span class="id" type="var">st</span> <span class="id" type="var">X</span>) ↔ <span class="id" type="var">ev</span> <span class="id" type="var">m</span>) <span style='letter-spacing:-.4em;'>}</span>}<br/>
&nbsp;<span class="id" type="var">END</span><br/>
&nbsp;<span style='letter-spacing:-.4em;'>{</span>{ <span class="id" type="keyword">fun</span> <span class="id" type="var">st</span> ⇒ (<span class="id" type="var">ev</span> (<span class="id" type="var">st</span> <span class="id" type="var">X</span>) ↔ <span class="id" type="var">ev</span> <span class="id" type="var">m</span>) ∧ ~(2 ≤ <span class="id" type="var">st</span> <span class="id" type="var">X</span>) <span style='letter-spacing:-.4em;'>}</span>} <span class="nowrap"><span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>-</span></span><span style='letter-spacing:-.2em;'>></span>></span></span><br/>
&nbsp;<span style='letter-spacing:-.4em;'>{</span>{ <span class="id" type="keyword">fun</span> <span class="id" type="var">st</span> ⇒ <span class="id" type="var">st</span> <span class="id" type="var">X</span>=0 ↔ <span class="id" type="var">ev</span> <span class="id" type="var">m</span> <span style='letter-spacing:-.4em;'>}</span>}.<br/><hr class='doublespaceincode'/>
<span class="id" type="keyword">Lemma</span> <span class="id" type="var">l<sub>4</sub></span> : <span style='font-size:120%;'>&forall;</span><span class="id" type="var">m</span>,<br/>
&nbsp;&nbsp;2 ≤ <span class="id" type="var">m</span> →<br/>
&nbsp;&nbsp;(<span class="id" type="var">ev</span> (<span class="id" type="var">m</span> - 2) ↔ <span class="id" type="var">ev</span> <span class="id" type="var">m</span>).<br/>
<span class="id" type="keyword">Proof</span>.<br/>
&nbsp;&nbsp;<span class="id" type="tactic">induction</span> <span class="id" type="var">m</span>; <span class="id" type="tactic">intros</span>. <span class="id" type="tactic">split</span>; <span class="id" type="tactic">intro</span>; <span class="id" type="var">constructor</span>.<br/>
&nbsp;&nbsp;<span class="id" type="tactic">destruct</span> <span class="id" type="var">m</span>. <span class="id" type="tactic">inversion</span> <span class="id" type="var">H</span>. <span class="id" type="tactic">inversion</span> <span class="id" type="var">H<sub>1</sub></span>. <span class="id" type="tactic">simpl</span> <span class="id" type="keyword">in</span> *.<br/>
&nbsp;&nbsp;<span class="id" type="tactic">rewrite</span> &lt;- <span class="id" type="var">minus_n_O</span> <span class="id" type="keyword">in</span> *. <span class="id" type="tactic">split</span>; <span class="id" type="tactic">intro</span>.<br/>
&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="var">constructor</span>. <span class="id" type="tactic">assumption</span>.<br/>
&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="tactic">inversion</span> <span class="id" type="var">H<sub>0</sub></span>. <span class="id" type="tactic">assumption</span>.<br/>
<span class="id" type="keyword">Qed</span>.<br/><hr class='doublespaceincode'/>
<span class="id" type="keyword">Theorem</span> <span class="id" type="var">find_parity_correct'</span> : <span style='font-size:120%;'>&forall;</span><span class="id" type="var">m</span>,<br/>
&nbsp;&nbsp;<span class="id" type="var">dec_correct</span> (<span class="id" type="var">find_parity_dec'</span> <span class="id" type="var">m</span>).<br/>
<span class="id" type="keyword">Proof</span>.<br/>
&nbsp;&nbsp;<span class="id" type="tactic">intros</span> <span class="id" type="var">m</span>. <span class="id" type="var">verify</span>;<br/>
&nbsp;&nbsp;&nbsp;&nbsp;<span class="comment">(*&nbsp;simplification&nbsp;too&nbsp;aggressive&nbsp;...&nbsp;reverting&nbsp;a&nbsp;bit&nbsp;*)</span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="var">fold</span> (2 &lt;=? (<span class="id" type="var">st</span> <span class="id" type="var">X</span>)) <span class="id" type="keyword">in</span> *;<br/>
&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="tactic">try</span> <span class="id" type="tactic">rewrite</span> <span class="id" type="var">leb_iff</span> <span class="id" type="keyword">in</span> *;<br/>
&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="tactic">try</span> <span class="id" type="tactic">rewrite</span> <span class="id" type="var">leb_iff_conv</span> <span class="id" type="keyword">in</span> *; <span class="id" type="tactic">intuition</span>; <span class="id" type="tactic">eauto</span>; <span class="id" type="tactic">try</span> <span class="id" type="tactic">omega</span>.<br/>
&nbsp;&nbsp;- <span class="comment">(*&nbsp;invariant&nbsp;preserved&nbsp;(part&nbsp;1)&nbsp;*)</span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="tactic">rewrite</span> <span class="id" type="var">l<sub>4</sub></span> <span class="id" type="keyword">in</span> <span class="id" type="var">H<sub>0</sub></span>; <span class="id" type="tactic">eauto</span>.<br/>
&nbsp;&nbsp;- <span class="comment">(*&nbsp;invariant&nbsp;preserved&nbsp;(part&nbsp;2)&nbsp;*)</span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="tactic">rewrite</span> <span class="id" type="var">l<sub>4</sub></span>; <span class="id" type="tactic">eauto</span>.<br/>
&nbsp;&nbsp;- <span class="comment">(*&nbsp;invariant&nbsp;strong&nbsp;enough&nbsp;to&nbsp;imply&nbsp;conclusion<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;(<span class="nowrap"><span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>-</span></span>&gt;</span></span>&nbsp;direction)&nbsp;*)</span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="tactic">apply</span> <span class="id" type="var">H<sub>0</sub></span>. <span class="id" type="var">constructor</span>.<br/>
&nbsp;&nbsp;- <span class="comment">(*&nbsp;invariant&nbsp;strong&nbsp;enough&nbsp;to&nbsp;imply&nbsp;conclusion<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;(&lt;-&nbsp;direction)&nbsp;*)</span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="tactic">destruct</span> (<span class="id" type="var">st</span> <span class="id" type="var">X</span>) <span class="id" type="keyword">as</span> [| [| <span class="id" type="var">n</span>]]. <span class="comment">(*&nbsp;by&nbsp;H<sub>1</sub>&nbsp;X&nbsp;can&nbsp;only&nbsp;be&nbsp;0&nbsp;or&nbsp;1&nbsp;*)</span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;+ <span class="comment">(*&nbsp;st&nbsp;X&nbsp;=&nbsp;0&nbsp;*)</span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="tactic">reflexivity</span>.<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;+ <span class="comment">(*&nbsp;st&nbsp;X&nbsp;=&nbsp;1&nbsp;*)</span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="tactic">inversion</span> <span class="id" type="var">H</span>.<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;+ <span class="comment">(*&nbsp;st&nbsp;X&nbsp;=&nbsp;2&nbsp;*)</span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="tactic">clear</span> <span class="id" type="var">H<sub>0</sub></span> <span class="id" type="var">H</span> <span class="id" type="var">H<sub>3</sub></span>. <span class="comment">(*&nbsp;omega&nbsp;confused&nbsp;otherwise&nbsp;*)</span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="tactic">omega</span>.<br/>
<span class="id" type="keyword">Qed</span>.<br/>
</div>

<div class="doc">
Here is the simplest invariant we've found for this program: 
</div>
<div class="code code-tight">

<span class="id" type="keyword">Definition</span> <span class="id" type="var">parity_dec</span> <span class="id" type="var">m</span> : <span class="id" type="var">decorated</span> :=<br/>
&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{ <span class="id" type="keyword">fun</span> <span class="id" type="var">st</span> ⇒ <span class="id" type="var">st</span> <span class="id" type="var">X</span> = <span class="id" type="var">m</span><span style='letter-spacing:-.4em;'>}</span>} <span class="nowrap"><span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>-</span></span><span style='letter-spacing:-.2em;'>></span>></span></span><br/>
&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{ <span class="id" type="keyword">fun</span> <span class="id" type="var">st</span> ⇒ <span class="id" type="var">parity</span> (<span class="id" type="var">st</span> <span class="id" type="var">X</span>) = <span class="id" type="var">parity</span> <span class="id" type="var">m</span> <span style='letter-spacing:-.4em;'>}</span>}<br/>
&nbsp;<span class="id" type="var">WHILE</span> 2 ≤ <span class="id" type="var">X</span> <span class="id" type="var">DO</span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{ <span class="id" type="keyword">fun</span> <span class="id" type="var">st</span> ⇒ <span class="id" type="var">parity</span> (<span class="id" type="var">st</span> <span class="id" type="var">X</span>) = <span class="id" type="var">parity</span> <span class="id" type="var">m</span> ∧ 2 ≤ <span class="id" type="var">st</span> <span class="id" type="var">X</span> <span style='letter-spacing:-.4em;'>}</span>} <span class="nowrap"><span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>-</span></span><span style='letter-spacing:-.2em;'>></span>></span></span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{ <span class="id" type="keyword">fun</span> <span class="id" type="var">st</span> ⇒ <span class="id" type="var">parity</span> (<span class="id" type="var">st</span> <span class="id" type="var">X</span> - 2) = <span class="id" type="var">parity</span> <span class="id" type="var">m</span> <span style='letter-spacing:-.4em;'>}</span>}<br/>
&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="var">X</span> <span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>:</span>:</span>=</span> <span class="id" type="var">X</span> - 2<br/>
&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{ <span class="id" type="keyword">fun</span> <span class="id" type="var">st</span> ⇒ <span class="id" type="var">parity</span> (<span class="id" type="var">st</span> <span class="id" type="var">X</span>) = <span class="id" type="var">parity</span> <span class="id" type="var">m</span> <span style='letter-spacing:-.4em;'>}</span>}<br/>
&nbsp;<span class="id" type="var">END</span><br/>
&nbsp;<span style='letter-spacing:-.4em;'>{</span>{ <span class="id" type="keyword">fun</span> <span class="id" type="var">st</span> ⇒ <span class="id" type="var">parity</span> (<span class="id" type="var">st</span> <span class="id" type="var">X</span>) = <span class="id" type="var">parity</span> <span class="id" type="var">m</span> ∧ ~(2 ≤ <span class="id" type="var">st</span> <span class="id" type="var">X</span>) <span style='letter-spacing:-.4em;'>}</span>} <span class="nowrap"><span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>-</span></span><span style='letter-spacing:-.2em;'>></span>></span></span><br/>
&nbsp;<span style='letter-spacing:-.4em;'>{</span>{ <span class="id" type="keyword">fun</span> <span class="id" type="var">st</span> ⇒ <span class="id" type="var">st</span> <span class="id" type="var">X</span> = <span class="id" type="var">parity</span> <span class="id" type="var">m</span> <span style='letter-spacing:-.4em;'>}</span>}.<br/><hr class='doublespaceincode'/>
<span class="id" type="keyword">Theorem</span> <span class="id" type="var">parity_dec_correct</span> : <span style='font-size:120%;'>&forall;</span><span class="id" type="var">m</span>,<br/>
&nbsp;&nbsp;<span class="id" type="var">dec_correct</span> (<span class="id" type="var">parity_dec</span> <span class="id" type="var">m</span>).<br/>
<span class="id" type="keyword">Proof</span>.<br/>
&nbsp;&nbsp;<span class="id" type="tactic">intros</span>. <span class="id" type="var">verify</span>;<br/>
&nbsp;&nbsp;&nbsp;&nbsp;<span class="comment">(*&nbsp;simplification&nbsp;too&nbsp;aggressive&nbsp;...&nbsp;reverting&nbsp;a&nbsp;bit&nbsp;*)</span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="var">fold</span> (2 &lt;=? (<span class="id" type="var">st</span> <span class="id" type="var">X</span>)) <span class="id" type="keyword">in</span> *;<br/>
&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="tactic">try</span> <span class="id" type="tactic">rewrite</span> <span class="id" type="var">leb_iff</span> <span class="id" type="keyword">in</span> *;<br/>
&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="tactic">try</span> <span class="id" type="tactic">rewrite</span> <span class="id" type="var">leb_iff_conv</span> <span class="id" type="keyword">in</span> *; <span class="id" type="tactic">eauto</span>; <span class="id" type="tactic">try</span> <span class="id" type="tactic">omega</span>.<br/>
&nbsp;&nbsp;- <span class="comment">(*&nbsp;invariant&nbsp;preserved&nbsp;*)</span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="tactic">rewrite</span> &lt;- <span class="id" type="var">H</span>. <span class="id" type="tactic">apply</span> <span class="id" type="var">parity_ge_2</span>. <span class="id" type="tactic">assumption</span>.<br/>
&nbsp;&nbsp;- <span class="comment">(*&nbsp;invariant&nbsp;strong&nbsp;enough&nbsp;*)</span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="tactic">rewrite</span> &lt;- <span class="id" type="var">H</span>. <span class="id" type="tactic">symmetry</span>. <span class="id" type="tactic">apply</span> <span class="id" type="var">parity_lt_2</span>. <span class="id" type="tactic">assumption</span>.<br/>
<span class="id" type="keyword">Qed</span>.<br/>
</div>

<div class="doc">
<a name="lab117"></a><h3 class="section">Square Roots</h3>

</div>
<div class="code code-space">

<br/>
<span class="id" type="keyword">Definition</span> <span class="id" type="var">sqrt_dec</span> <span class="id" type="var">m</span> : <span class="id" type="var">decorated</span> :=<br/>
&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{ <span class="id" type="keyword">fun</span> <span class="id" type="var">st</span> ⇒ <span class="id" type="var">st</span> <span class="id" type="var">X</span> = <span class="id" type="var">m</span> <span style='letter-spacing:-.4em;'>}</span>} <span class="nowrap"><span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>-</span></span><span style='letter-spacing:-.2em;'>></span>></span></span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{ <span class="id" type="keyword">fun</span> <span class="id" type="var">st</span> ⇒ <span class="id" type="var">st</span> <span class="id" type="var">X</span> = <span class="id" type="var">m</span> ∧ 0*0 ≤ <span class="id" type="var">m</span> <span style='letter-spacing:-.4em;'>}</span>}<br/>
&nbsp;&nbsp;<span class="id" type="var">Z</span> <span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>:</span>:</span>=</span> 0<br/>
&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{ <span class="id" type="keyword">fun</span> <span class="id" type="var">st</span> ⇒ <span class="id" type="var">st</span> <span class="id" type="var">X</span> = <span class="id" type="var">m</span> ∧ <span class="id" type="var">st</span> <span class="id" type="var">Z</span>*<span class="id" type="var">st</span> <span class="id" type="var">Z</span> ≤ <span class="id" type="var">m</span> <span style='letter-spacing:-.4em;'>}</span>};;<br/>
&nbsp;&nbsp;<span class="id" type="var">WHILE</span> (<span class="id" type="var">Z</span>+1)*(<span class="id" type="var">Z</span>+1) ≤ <span class="id" type="var">X</span> <span class="id" type="var">DO</span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{ <span class="id" type="keyword">fun</span> <span class="id" type="var">st</span> ⇒ (<span class="id" type="var">st</span> <span class="id" type="var">X</span> = <span class="id" type="var">m</span> ∧ <span class="id" type="var">st</span> <span class="id" type="var">Z</span>*<span class="id" type="var">st</span> <span class="id" type="var">Z</span>≤<span class="id" type="var">m</span>)<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;∧ (<span class="id" type="var">st</span> <span class="id" type="var">Z</span> + 1)*(<span class="id" type="var">st</span> <span class="id" type="var">Z</span> + 1) ≤ <span class="id" type="var">st</span> <span class="id" type="var">X</span> <span style='letter-spacing:-.4em;'>}</span>} <span class="nowrap"><span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>-</span></span><span style='letter-spacing:-.2em;'>></span>></span></span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{ <span class="id" type="keyword">fun</span> <span class="id" type="var">st</span> ⇒ <span class="id" type="var">st</span> <span class="id" type="var">X</span> = <span class="id" type="var">m</span> ∧ (<span class="id" type="var">st</span> <span class="id" type="var">Z</span>+1)*(<span class="id" type="var">st</span> <span class="id" type="var">Z</span>+1)≤<span class="id" type="var">m</span> <span style='letter-spacing:-.4em;'>}</span>}<br/>
&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="var">Z</span> <span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>:</span>:</span>=</span> <span class="id" type="var">Z</span> + 1<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{ <span class="id" type="keyword">fun</span> <span class="id" type="var">st</span> ⇒ <span class="id" type="var">st</span> <span class="id" type="var">X</span> = <span class="id" type="var">m</span> ∧ <span class="id" type="var">st</span> <span class="id" type="var">Z</span>*<span class="id" type="var">st</span> <span class="id" type="var">Z</span>≤<span class="id" type="var">m</span> <span style='letter-spacing:-.4em;'>}</span>}<br/>
&nbsp;&nbsp;<span class="id" type="var">END</span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{ <span class="id" type="keyword">fun</span> <span class="id" type="var">st</span> ⇒ (<span class="id" type="var">st</span> <span class="id" type="var">X</span> = <span class="id" type="var">m</span> ∧ <span class="id" type="var">st</span> <span class="id" type="var">Z</span>*<span class="id" type="var">st</span> <span class="id" type="var">Z</span>≤<span class="id" type="var">m</span>)<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;∧ ~((<span class="id" type="var">st</span> <span class="id" type="var">Z</span> + 1)*(<span class="id" type="var">st</span> <span class="id" type="var">Z</span> + 1) ≤ <span class="id" type="var">st</span> <span class="id" type="var">X</span>) <span style='letter-spacing:-.4em;'>}</span>} <span class="nowrap"><span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>-</span></span><span style='letter-spacing:-.2em;'>></span>></span></span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{ <span class="id" type="keyword">fun</span> <span class="id" type="var">st</span> ⇒ <span class="id" type="var">st</span> <span class="id" type="var">Z</span>*<span class="id" type="var">st</span> <span class="id" type="var">Z</span>≤<span class="id" type="var">m</span> ∧ <span class="id" type="var">m</span>&lt;(<span class="id" type="var">st</span> <span class="id" type="var">Z</span>+1)*(<span class="id" type="var">st</span> <span class="id" type="var">Z</span>+1) <span style='letter-spacing:-.4em;'>}</span>}.<br/><hr class='doublespaceincode'/>
<span class="id" type="keyword">Theorem</span> <span class="id" type="var">sqrt_correct</span> : <span style='font-size:120%;'>&forall;</span><span class="id" type="var">m</span>,<br/>
&nbsp;&nbsp;<span class="id" type="var">dec_correct</span> (<span class="id" type="var">sqrt_dec</span> <span class="id" type="var">m</span>).<br/>
<span class="id" type="keyword">Proof</span>. <span class="id" type="tactic">intro</span> <span class="id" type="var">m</span>. <span class="id" type="var">verify</span>. <span class="id" type="keyword">Qed</span>.<br/>
</div>

<div class="doc">
<a name="lab118"></a><h3 class="section">Squaring</h3>

<div class="paragraph"> </div>

 Again, there are several ways of annotating the squaring program.
    The simplest variant we've found, <span class="inlinecode"><span class="id" type="var">square_simpler_dec</span></span>, is given
    last. 
</div>
<div class="code code-tight">

<span class="id" type="keyword">Definition</span> <span class="id" type="var">square_dec</span> (<span class="id" type="var">m</span> : <span class="id" type="var">nat</span>) : <span class="id" type="var">decorated</span> :=<br/>
&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{ <span class="id" type="keyword">fun</span> <span class="id" type="var">st</span> ⇒ <span class="id" type="var">st</span> <span class="id" type="var">X</span> = <span class="id" type="var">m</span> <span style='letter-spacing:-.4em;'>}</span>}<br/>
&nbsp;&nbsp;<span class="id" type="var">Y</span> <span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>:</span>:</span>=</span> <span class="id" type="var">X</span><br/>
&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{ <span class="id" type="keyword">fun</span> <span class="id" type="var">st</span> ⇒ <span class="id" type="var">st</span> <span class="id" type="var">X</span> = <span class="id" type="var">m</span> ∧ <span class="id" type="var">st</span> <span class="id" type="var">Y</span> = <span class="id" type="var">m</span> <span style='letter-spacing:-.4em;'>}</span>};;<br/>
&nbsp;&nbsp;<span class="id" type="var">Z</span> <span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>:</span>:</span>=</span> 0<br/>
&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{ <span class="id" type="keyword">fun</span> <span class="id" type="var">st</span> ⇒ <span class="id" type="var">st</span> <span class="id" type="var">X</span> = <span class="id" type="var">m</span> ∧ <span class="id" type="var">st</span> <span class="id" type="var">Y</span> = <span class="id" type="var">m</span> ∧ <span class="id" type="var">st</span> <span class="id" type="var">Z</span> = 0<span style='letter-spacing:-.4em;'>}</span>} <span class="nowrap"><span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>-</span></span><span style='letter-spacing:-.2em;'>></span>></span></span><br/>
&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{ <span class="id" type="keyword">fun</span> <span class="id" type="var">st</span> ⇒ <span class="id" type="var">st</span> <span class="id" type="var">Z</span> + <span class="id" type="var">st</span> <span class="id" type="var">X</span> * <span class="id" type="var">st</span> <span class="id" type="var">Y</span> = <span class="id" type="var">m</span> * <span class="id" type="var">m</span> <span style='letter-spacing:-.4em;'>}</span>};;<br/>
&nbsp;&nbsp;<span class="id" type="var">WHILE</span> ~(<span class="id" type="var">Y</span> = 0) <span class="id" type="var">DO</span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{ <span class="id" type="keyword">fun</span> <span class="id" type="var">st</span> ⇒ <span class="id" type="var">st</span> <span class="id" type="var">Z</span> + <span class="id" type="var">st</span> <span class="id" type="var">X</span> * <span class="id" type="var">st</span> <span class="id" type="var">Y</span> = <span class="id" type="var">m</span> * <span class="id" type="var">m</span> ∧ <span class="id" type="var">st</span> <span class="id" type="var">Y</span> ≠ 0 <span style='letter-spacing:-.4em;'>}</span>} <span class="nowrap"><span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>-</span></span><span style='letter-spacing:-.2em;'>></span>></span></span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{ <span class="id" type="keyword">fun</span> <span class="id" type="var">st</span> ⇒ (<span class="id" type="var">st</span> <span class="id" type="var">Z</span> + <span class="id" type="var">st</span> <span class="id" type="var">X</span>) + <span class="id" type="var">st</span> <span class="id" type="var">X</span> * (<span class="id" type="var">st</span> <span class="id" type="var">Y</span> - 1) = <span class="id" type="var">m</span> * <span class="id" type="var">m</span> <span style='letter-spacing:-.4em;'>}</span>}<br/>
&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="var">Z</span> <span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>:</span>:</span>=</span> <span class="id" type="var">Z</span> + <span class="id" type="var">X</span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{ <span class="id" type="keyword">fun</span> <span class="id" type="var">st</span> ⇒ <span class="id" type="var">st</span> <span class="id" type="var">Z</span> + <span class="id" type="var">st</span> <span class="id" type="var">X</span> * (<span class="id" type="var">st</span> <span class="id" type="var">Y</span> - 1) = <span class="id" type="var">m</span> * <span class="id" type="var">m</span> <span style='letter-spacing:-.4em;'>}</span>};;<br/>
&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="var">Y</span> <span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>:</span>:</span>=</span> <span class="id" type="var">Y</span> - 1<br/>
&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{ <span class="id" type="keyword">fun</span> <span class="id" type="var">st</span> ⇒ <span class="id" type="var">st</span> <span class="id" type="var">Z</span> + <span class="id" type="var">st</span> <span class="id" type="var">X</span> * <span class="id" type="var">st</span> <span class="id" type="var">Y</span> = <span class="id" type="var">m</span> * <span class="id" type="var">m</span> <span style='letter-spacing:-.4em;'>}</span>}<br/>
&nbsp;&nbsp;<span class="id" type="var">END</span><br/>
&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{ <span class="id" type="keyword">fun</span> <span class="id" type="var">st</span> ⇒ <span class="id" type="var">st</span> <span class="id" type="var">Z</span> + <span class="id" type="var">st</span> <span class="id" type="var">X</span> * <span class="id" type="var">st</span> <span class="id" type="var">Y</span> = <span class="id" type="var">m</span> * <span class="id" type="var">m</span> ∧ <span class="id" type="var">st</span> <span class="id" type="var">Y</span> = 0 <span style='letter-spacing:-.4em;'>}</span>} <span class="nowrap"><span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>-</span></span><span style='letter-spacing:-.2em;'>></span>></span></span><br/>
&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{ <span class="id" type="keyword">fun</span> <span class="id" type="var">st</span> ⇒ <span class="id" type="var">st</span> <span class="id" type="var">Z</span> = <span class="id" type="var">m</span> * <span class="id" type="var">m</span> <span style='letter-spacing:-.4em;'>}</span>}.<br/><hr class='doublespaceincode'/>
<span class="id" type="keyword">Theorem</span> <span class="id" type="var">square_dec_correct</span> : <span style='font-size:120%;'>&forall;</span><span class="id" type="var">m</span>,<br/>
&nbsp;&nbsp;<span class="id" type="var">dec_correct</span> (<span class="id" type="var">square_dec</span> <span class="id" type="var">m</span>).<br/>
<span class="id" type="keyword">Proof</span>.<br/>
&nbsp;&nbsp;<span class="id" type="tactic">intro</span> <span class="id" type="var">n</span>. <span class="id" type="var">verify</span>.<br/>
&nbsp;&nbsp;- <span class="comment">(*&nbsp;invariant&nbsp;preserved&nbsp;*)</span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="tactic">destruct</span> (<span class="id" type="var">st</span> <span class="id" type="var">Y</span>) <span class="id" type="keyword">as</span> [| <span class="id" type="var">y'</span>]. <span class="id" type="tactic">apply</span> <span class="id" type="var">False_ind</span>. <span class="id" type="tactic">apply</span> <span class="id" type="var">H<sub>0</sub></span>.<br/>
&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="tactic">reflexivity</span>.<br/>
&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="tactic">simpl</span>. <span class="id" type="tactic">rewrite</span> &lt;- <span class="id" type="var">minus_n_O</span>.<br/>
&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="tactic">assert</span> (<span class="id" type="var">G</span> : <span style='font-size:120%;'>&forall;</span><span class="id" type="var">n</span> <span class="id" type="var">m</span>, <span class="id" type="var">n</span> * <span class="id" type="var">S</span> <span class="id" type="var">m</span> = <span class="id" type="var">n</span> + <span class="id" type="var">n</span> * <span class="id" type="var">m</span>). {<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="tactic">clear</span>. <span class="id" type="tactic">intros</span>. <span class="id" type="tactic">induction</span> <span class="id" type="var">n</span>. <span class="id" type="tactic">reflexivity</span>. <span class="id" type="tactic">simpl</span>.<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="tactic">rewrite</span> <span class="id" type="var">IHn</span>. <span class="id" type="tactic">omega</span>. }<br/>
&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="tactic">rewrite</span> &lt;- <span class="id" type="var">H</span>. <span class="id" type="tactic">rewrite</span> <span class="id" type="var">G</span>. <span class="id" type="tactic">rewrite</span> <span class="id" type="var">plus_assoc</span>. <span class="id" type="tactic">reflexivity</span>.<br/>
<span class="id" type="keyword">Qed</span>.<br/><hr class='doublespaceincode'/>
<span class="id" type="keyword">Definition</span> <span class="id" type="var">square_dec'</span> (<span class="id" type="var">n</span> : <span class="id" type="var">nat</span>) : <span class="id" type="var">decorated</span> :=<br/>
&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{ <span class="id" type="keyword">fun</span> <span class="id" type="var">st</span> ⇒ <span class="id" type="var">True</span> <span style='letter-spacing:-.4em;'>}</span>}<br/>
&nbsp;&nbsp;<span class="id" type="var">X</span> <span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>:</span>:</span>=</span> <span class="id" type="var">n</span><br/>
&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{ <span class="id" type="keyword">fun</span> <span class="id" type="var">st</span> ⇒ <span class="id" type="var">st</span> <span class="id" type="var">X</span> = <span class="id" type="var">n</span> <span style='letter-spacing:-.4em;'>}</span>};;<br/>
&nbsp;&nbsp;<span class="id" type="var">Y</span> <span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>:</span>:</span>=</span> <span class="id" type="var">X</span><br/>
&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{ <span class="id" type="keyword">fun</span> <span class="id" type="var">st</span> ⇒ <span class="id" type="var">st</span> <span class="id" type="var">X</span> = <span class="id" type="var">n</span> ∧ <span class="id" type="var">st</span> <span class="id" type="var">Y</span> = <span class="id" type="var">n</span> <span style='letter-spacing:-.4em;'>}</span>};;<br/>
&nbsp;&nbsp;<span class="id" type="var">Z</span> <span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>:</span>:</span>=</span> 0<br/>
&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{ <span class="id" type="keyword">fun</span> <span class="id" type="var">st</span> ⇒ <span class="id" type="var">st</span> <span class="id" type="var">X</span> = <span class="id" type="var">n</span> ∧ <span class="id" type="var">st</span> <span class="id" type="var">Y</span> = <span class="id" type="var">n</span> ∧ <span class="id" type="var">st</span> <span class="id" type="var">Z</span> = 0 <span style='letter-spacing:-.4em;'>}</span>} <span class="nowrap"><span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>-</span></span><span style='letter-spacing:-.2em;'>></span>></span></span><br/>
&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{ <span class="id" type="keyword">fun</span> <span class="id" type="var">st</span> ⇒ <span class="id" type="var">st</span> <span class="id" type="var">Z</span> = <span class="id" type="var">st</span> <span class="id" type="var">X</span> * (<span class="id" type="var">st</span> <span class="id" type="var">X</span> - <span class="id" type="var">st</span> <span class="id" type="var">Y</span>)<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;∧ <span class="id" type="var">st</span> <span class="id" type="var">X</span> = <span class="id" type="var">n</span> ∧ <span class="id" type="var">st</span> <span class="id" type="var">Y</span> ≤ <span class="id" type="var">st</span> <span class="id" type="var">X</span> <span style='letter-spacing:-.4em;'>}</span>};;<br/>
&nbsp;&nbsp;<span class="id" type="var">WHILE</span> ~(<span class="id" type="var">Y</span> = 0) <span class="id" type="var">DO</span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{ <span class="id" type="keyword">fun</span> <span class="id" type="var">st</span> ⇒ (<span class="id" type="var">st</span> <span class="id" type="var">Z</span> = <span class="id" type="var">st</span> <span class="id" type="var">X</span> * (<span class="id" type="var">st</span> <span class="id" type="var">X</span> - <span class="id" type="var">st</span> <span class="id" type="var">Y</span>)<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;∧ <span class="id" type="var">st</span> <span class="id" type="var">X</span> = <span class="id" type="var">n</span> ∧ <span class="id" type="var">st</span> <span class="id" type="var">Y</span> ≤ <span class="id" type="var">st</span> <span class="id" type="var">X</span>)<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;∧ <span class="id" type="var">st</span> <span class="id" type="var">Y</span> ≠ 0 <span style='letter-spacing:-.4em;'>}</span>}<br/>
&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="var">Z</span> <span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>:</span>:</span>=</span> <span class="id" type="var">Z</span> + <span class="id" type="var">X</span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{ <span class="id" type="keyword">fun</span> <span class="id" type="var">st</span> ⇒ <span class="id" type="var">st</span> <span class="id" type="var">Z</span> = <span class="id" type="var">st</span> <span class="id" type="var">X</span> * (<span class="id" type="var">st</span> <span class="id" type="var">X</span> - (<span class="id" type="var">st</span> <span class="id" type="var">Y</span> - 1))<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;∧ <span class="id" type="var">st</span> <span class="id" type="var">X</span> = <span class="id" type="var">n</span> ∧ <span class="id" type="var">st</span> <span class="id" type="var">Y</span> ≤ <span class="id" type="var">st</span> <span class="id" type="var">X</span> <span style='letter-spacing:-.4em;'>}</span>};;<br/>
&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="var">Y</span> <span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>:</span>:</span>=</span> <span class="id" type="var">Y</span> - 1<br/>
&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{ <span class="id" type="keyword">fun</span> <span class="id" type="var">st</span> ⇒ <span class="id" type="var">st</span> <span class="id" type="var">Z</span> = <span class="id" type="var">st</span> <span class="id" type="var">X</span> * (<span class="id" type="var">st</span> <span class="id" type="var">X</span> - <span class="id" type="var">st</span> <span class="id" type="var">Y</span>)<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;∧ <span class="id" type="var">st</span> <span class="id" type="var">X</span> = <span class="id" type="var">n</span> ∧ <span class="id" type="var">st</span> <span class="id" type="var">Y</span> ≤ <span class="id" type="var">st</span> <span class="id" type="var">X</span> <span style='letter-spacing:-.4em;'>}</span>}<br/>
&nbsp;&nbsp;<span class="id" type="var">END</span><br/>
&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{ <span class="id" type="keyword">fun</span> <span class="id" type="var">st</span> ⇒ (<span class="id" type="var">st</span> <span class="id" type="var">Z</span> = <span class="id" type="var">st</span> <span class="id" type="var">X</span> * (<span class="id" type="var">st</span> <span class="id" type="var">X</span> - <span class="id" type="var">st</span> <span class="id" type="var">Y</span>)<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;∧ <span class="id" type="var">st</span> <span class="id" type="var">X</span> = <span class="id" type="var">n</span> ∧ <span class="id" type="var">st</span> <span class="id" type="var">Y</span> ≤ <span class="id" type="var">st</span> <span class="id" type="var">X</span>)<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;∧ <span class="id" type="var">st</span> <span class="id" type="var">Y</span> = 0 <span style='letter-spacing:-.4em;'>}</span>} <span class="nowrap"><span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>-</span></span><span style='letter-spacing:-.2em;'>></span>></span></span><br/>
&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{ <span class="id" type="keyword">fun</span> <span class="id" type="var">st</span> ⇒ <span class="id" type="var">st</span> <span class="id" type="var">Z</span> = <span class="id" type="var">n</span> * <span class="id" type="var">n</span> <span style='letter-spacing:-.4em;'>}</span>}.<br/><hr class='doublespaceincode'/>
<span class="id" type="keyword">Theorem</span> <span class="id" type="var">square_dec'_correct</span> : <span style='font-size:120%;'>&forall;</span><span class="id" type="var">n</span>,<br/>
&nbsp;&nbsp;<span class="id" type="var">dec_correct</span> (<span class="id" type="var">square_dec'</span> <span class="id" type="var">n</span>).<br/>
<span class="id" type="keyword">Proof</span>.<br/>
&nbsp;&nbsp;<span class="id" type="tactic">intro</span> <span class="id" type="var">n</span>. <span class="id" type="var">verify</span>.<br/>
&nbsp;&nbsp;- <span class="comment">(*&nbsp;invariant&nbsp;holds&nbsp;initially&nbsp;*)</span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="tactic">rewrite</span> <span class="id" type="var">minus_diag</span>. <span class="id" type="tactic">omega</span>.<br/>
&nbsp;&nbsp;- <span class="comment">(*&nbsp;invariant&nbsp;preserved&nbsp;*)</span> <span class="id" type="tactic">subst</span>.<br/>
&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="tactic">rewrite</span> <span class="id" type="var">mult_minus_distr_l</span>.<br/>
&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="tactic">repeat</span> <span class="id" type="tactic">rewrite</span> <span class="id" type="var">mult_minus_distr_l</span>. <span class="id" type="tactic">rewrite</span> <span class="id" type="var">mult_1_r</span>.<br/>
&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="tactic">assert</span> (<span class="id" type="var">G</span> : <span style='font-size:120%;'>&forall;</span><span class="id" type="var">n</span> <span class="id" type="var">m</span> <span class="id" type="var">p</span>,<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="var">m</span> ≤ <span class="id" type="var">n</span> → <span class="id" type="var">p</span> ≤ <span class="id" type="var">m</span> → <span class="id" type="var">n</span> - (<span class="id" type="var">m</span> - <span class="id" type="var">p</span>) = <span class="id" type="var">n</span> - <span class="id" type="var">m</span> + <span class="id" type="var">p</span>).<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="tactic">intros</span>. <span class="id" type="tactic">omega</span>.<br/>
&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="tactic">rewrite</span> <span class="id" type="var">G</span>. <span class="id" type="tactic">reflexivity</span>. <span class="id" type="tactic">apply</span> <span class="id" type="var">mult_le_compat_l</span>. <span class="id" type="tactic">assumption</span>.<br/>
&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="tactic">destruct</span> (<span class="id" type="var">st</span> <span class="id" type="var">Y</span>). <span class="id" type="tactic">apply</span> <span class="id" type="var">False_ind</span>. <span class="id" type="tactic">apply</span> <span class="id" type="var">H<sub>0</sub></span>. <span class="id" type="tactic">reflexivity</span>.<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="tactic">clear</span>. <span class="id" type="tactic">rewrite</span> <span class="id" type="var">mult_succ_r</span>. <span class="id" type="tactic">rewrite</span> <span class="id" type="var">plus_comm</span>.<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="tactic">apply</span> <span class="id" type="var">le_plus_l</span>.<br/>
&nbsp;&nbsp;- <span class="comment">(*&nbsp;invariant&nbsp;+&nbsp;negation&nbsp;of&nbsp;guard&nbsp;imply<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;desired&nbsp;postcondition&nbsp;*)</span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="tactic">rewrite</span> &lt;- <span class="id" type="var">minus_n_O</span>. <span class="id" type="tactic">reflexivity</span>.<br/>
<span class="id" type="keyword">Qed</span>.<br/><hr class='doublespaceincode'/>
<span class="id" type="keyword">Definition</span> <span class="id" type="var">square_simpler_dec</span> (<span class="id" type="var">m</span> : <span class="id" type="var">nat</span>) : <span class="id" type="var">decorated</span> :=<br/>
&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{ <span class="id" type="keyword">fun</span> <span class="id" type="var">st</span> ⇒ <span class="id" type="var">st</span> <span class="id" type="var">X</span> = <span class="id" type="var">m</span> <span style='letter-spacing:-.4em;'>}</span>} <span class="nowrap"><span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>-</span></span><span style='letter-spacing:-.2em;'>></span>></span></span><br/>
&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{ <span class="id" type="keyword">fun</span> <span class="id" type="var">st</span> ⇒ 0 = 0*<span class="id" type="var">m</span> ∧ <span class="id" type="var">st</span> <span class="id" type="var">X</span> = <span class="id" type="var">m</span> <span style='letter-spacing:-.4em;'>}</span>}<br/>
&nbsp;&nbsp;<span class="id" type="var">Y</span> <span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>:</span>:</span>=</span> 0<br/>
&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{ <span class="id" type="keyword">fun</span> <span class="id" type="var">st</span> ⇒ 0 = (<span class="id" type="var">st</span> <span class="id" type="var">Y</span>)*<span class="id" type="var">m</span> ∧ <span class="id" type="var">st</span> <span class="id" type="var">X</span> = <span class="id" type="var">m</span> <span style='letter-spacing:-.4em;'>}</span>};;<br/>
&nbsp;&nbsp;<span class="id" type="var">Z</span> <span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>:</span>:</span>=</span> 0<br/>
&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{ <span class="id" type="keyword">fun</span> <span class="id" type="var">st</span> ⇒ <span class="id" type="var">st</span> <span class="id" type="var">Z</span> = (<span class="id" type="var">st</span> <span class="id" type="var">Y</span>)*<span class="id" type="var">m</span> ∧ <span class="id" type="var">st</span> <span class="id" type="var">X</span> = <span class="id" type="var">m</span> <span style='letter-spacing:-.4em;'>}</span>}<span class="nowrap"><span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>-</span></span><span style='letter-spacing:-.2em;'>></span>></span></span><br/>
&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{ <span class="id" type="keyword">fun</span> <span class="id" type="var">st</span> ⇒ <span class="id" type="var">st</span> <span class="id" type="var">Z</span> = (<span class="id" type="var">st</span> <span class="id" type="var">Y</span>)*<span class="id" type="var">m</span> ∧ <span class="id" type="var">st</span> <span class="id" type="var">X</span> = <span class="id" type="var">m</span> <span style='letter-spacing:-.4em;'>}</span>};;<br/>
&nbsp;&nbsp;<span class="id" type="var">WHILE</span> ~(<span class="id" type="var">Y</span> = <span class="id" type="var">X</span>) <span class="id" type="var">DO</span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{ <span class="id" type="keyword">fun</span> <span class="id" type="var">st</span> ⇒ (<span class="id" type="var">st</span> <span class="id" type="var">Z</span> = (<span class="id" type="var">st</span> <span class="id" type="var">Y</span>)*<span class="id" type="var">m</span> ∧ <span class="id" type="var">st</span> <span class="id" type="var">X</span> = <span class="id" type="var">m</span>)<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;∧ <span class="id" type="var">st</span> <span class="id" type="var">Y</span> ≠ <span class="id" type="var">st</span> <span class="id" type="var">X</span> <span style='letter-spacing:-.4em;'>}</span>} <span class="nowrap"><span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>-</span></span><span style='letter-spacing:-.2em;'>></span>></span></span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{ <span class="id" type="keyword">fun</span> <span class="id" type="var">st</span> ⇒ <span class="id" type="var">st</span> <span class="id" type="var">Z</span> + <span class="id" type="var">st</span> <span class="id" type="var">X</span> = ((<span class="id" type="var">st</span> <span class="id" type="var">Y</span>) + 1)*<span class="id" type="var">m</span> ∧ <span class="id" type="var">st</span> <span class="id" type="var">X</span> = <span class="id" type="var">m</span> <span style='letter-spacing:-.4em;'>}</span>}<br/>
&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="var">Z</span> <span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>:</span>:</span>=</span> <span class="id" type="var">Z</span> + <span class="id" type="var">X</span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{ <span class="id" type="keyword">fun</span> <span class="id" type="var">st</span> ⇒ <span class="id" type="var">st</span> <span class="id" type="var">Z</span> = ((<span class="id" type="var">st</span> <span class="id" type="var">Y</span>) + 1)*<span class="id" type="var">m</span> ∧ <span class="id" type="var">st</span> <span class="id" type="var">X</span> = <span class="id" type="var">m</span> <span style='letter-spacing:-.4em;'>}</span>};;<br/>
&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="var">Y</span> <span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>:</span>:</span>=</span> <span class="id" type="var">Y</span> + 1<br/>
&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{ <span class="id" type="keyword">fun</span> <span class="id" type="var">st</span> ⇒ <span class="id" type="var">st</span> <span class="id" type="var">Z</span> = (<span class="id" type="var">st</span> <span class="id" type="var">Y</span>)*<span class="id" type="var">m</span> ∧ <span class="id" type="var">st</span> <span class="id" type="var">X</span> = <span class="id" type="var">m</span> <span style='letter-spacing:-.4em;'>}</span>}<br/>
&nbsp;&nbsp;<span class="id" type="var">END</span><br/>
&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{ <span class="id" type="keyword">fun</span> <span class="id" type="var">st</span> ⇒ (<span class="id" type="var">st</span> <span class="id" type="var">Z</span> = (<span class="id" type="var">st</span> <span class="id" type="var">Y</span>)*<span class="id" type="var">m</span> ∧ <span class="id" type="var">st</span> <span class="id" type="var">X</span> = <span class="id" type="var">m</span>) ∧ <span class="id" type="var">st</span> <span class="id" type="var">Y</span> = <span class="id" type="var">st</span> <span class="id" type="var">X</span> <span style='letter-spacing:-.4em;'>}</span>} <span class="nowrap"><span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>-</span></span><span style='letter-spacing:-.2em;'>></span>></span></span><br/>
&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{ <span class="id" type="keyword">fun</span> <span class="id" type="var">st</span> ⇒ <span class="id" type="var">st</span> <span class="id" type="var">Z</span> = <span class="id" type="var">m</span>*<span class="id" type="var">m</span> <span style='letter-spacing:-.4em;'>}</span>}.<br/><hr class='doublespaceincode'/>
<span class="id" type="keyword">Theorem</span> <span class="id" type="var">square_simpler_dec_correct</span> : <span style='font-size:120%;'>&forall;</span><span class="id" type="var">m</span>,<br/>
&nbsp;&nbsp;<span class="id" type="var">dec_correct</span> (<span class="id" type="var">square_simpler_dec</span> <span class="id" type="var">m</span>).<br/>
<span class="id" type="keyword">Proof</span>.<br/>
&nbsp;&nbsp;<span class="id" type="tactic">intro</span> <span class="id" type="var">m</span>. <span class="id" type="var">verify</span>.<br/>
&nbsp;&nbsp;<span class="id" type="tactic">rewrite</span> <span class="id" type="var">mult_plus_distr_r</span>. <span class="id" type="tactic">simpl</span>. <span class="id" type="tactic">rewrite</span> &lt;- <span class="id" type="var">plus_n_O</span>.<br/>
&nbsp;&nbsp;<span class="id" type="tactic">reflexivity</span>.<br/>
<span class="id" type="keyword">Qed</span>.<br/>
</div>

<div class="doc">
<a name="lab119"></a><h3 class="section">Two loops</h3>

</div>
<div class="code code-space">

<br/>
<span class="id" type="keyword">Definition</span> <span class="id" type="var">two_loops_dec</span> (<span class="id" type="var">a</span> <span class="id" type="var">b</span> <span class="id" type="var">c</span> : <span class="id" type="var">nat</span>) : <span class="id" type="var">decorated</span> :=<br/>
&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{ <span class="id" type="keyword">fun</span> <span class="id" type="var">st</span> ⇒ <span class="id" type="var">True</span> <span style='letter-spacing:-.4em;'>}</span>} <span class="nowrap"><span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>-</span></span><span style='letter-spacing:-.2em;'>></span>></span></span><br/>
&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{ <span class="id" type="keyword">fun</span> <span class="id" type="var">st</span> ⇒ <span class="id" type="var">c</span> = 0 + <span class="id" type="var">c</span> ∧ 0 = 0 <span style='letter-spacing:-.4em;'>}</span>}<br/>
&nbsp;&nbsp;<span class="id" type="var">X</span> <span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>:</span>:</span>=</span> 0<br/>
&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{ <span class="id" type="keyword">fun</span> <span class="id" type="var">st</span> ⇒ <span class="id" type="var">c</span> = <span class="id" type="var">st</span> <span class="id" type="var">X</span> + <span class="id" type="var">c</span> ∧ 0 = 0 <span style='letter-spacing:-.4em;'>}</span>};;<br/>
&nbsp;&nbsp;<span class="id" type="var">Y</span> <span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>:</span>:</span>=</span> 0<br/>
&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{ <span class="id" type="keyword">fun</span> <span class="id" type="var">st</span> ⇒ <span class="id" type="var">c</span> = <span class="id" type="var">st</span> <span class="id" type="var">X</span> + <span class="id" type="var">c</span> ∧ <span class="id" type="var">st</span> <span class="id" type="var">Y</span> = 0 <span style='letter-spacing:-.4em;'>}</span>};;<br/>
&nbsp;&nbsp;<span class="id" type="var">Z</span> <span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>:</span>:</span>=</span> <span class="id" type="var">c</span><br/>
&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{ <span class="id" type="keyword">fun</span> <span class="id" type="var">st</span> ⇒ <span class="id" type="var">st</span> <span class="id" type="var">Z</span> = <span class="id" type="var">st</span> <span class="id" type="var">X</span> + <span class="id" type="var">c</span> ∧ <span class="id" type="var">st</span> <span class="id" type="var">Y</span> = 0 <span style='letter-spacing:-.4em;'>}</span>};;<br/>
&nbsp;&nbsp;<span class="id" type="var">WHILE</span> ~(<span class="id" type="var">X</span> = <span class="id" type="var">a</span>) <span class="id" type="var">DO</span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{ <span class="id" type="keyword">fun</span> <span class="id" type="var">st</span> ⇒ (<span class="id" type="var">st</span> <span class="id" type="var">Z</span> = <span class="id" type="var">st</span> <span class="id" type="var">X</span> + <span class="id" type="var">c</span> ∧ <span class="id" type="var">st</span> <span class="id" type="var">Y</span> = 0) ∧ <span class="id" type="var">st</span> <span class="id" type="var">X</span> ≠ <span class="id" type="var">a</span> <span style='letter-spacing:-.4em;'>}</span>} <span class="nowrap"><span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>-</span></span><span style='letter-spacing:-.2em;'>></span>></span></span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{ <span class="id" type="keyword">fun</span> <span class="id" type="var">st</span> ⇒ <span class="id" type="var">st</span> <span class="id" type="var">Z</span> + 1 = <span class="id" type="var">st</span> <span class="id" type="var">X</span> + 1 + <span class="id" type="var">c</span> ∧ <span class="id" type="var">st</span> <span class="id" type="var">Y</span> = 0 <span style='letter-spacing:-.4em;'>}</span>}<br/>
&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="var">X</span> <span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>:</span>:</span>=</span> <span class="id" type="var">X</span> + 1<br/>
&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{ <span class="id" type="keyword">fun</span> <span class="id" type="var">st</span> ⇒ <span class="id" type="var">st</span> <span class="id" type="var">Z</span> + 1 = <span class="id" type="var">st</span> <span class="id" type="var">X</span> + <span class="id" type="var">c</span> ∧ <span class="id" type="var">st</span> <span class="id" type="var">Y</span> = 0 <span style='letter-spacing:-.4em;'>}</span>};;<br/>
&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="var">Z</span> <span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>:</span>:</span>=</span> <span class="id" type="var">Z</span> + 1<br/>
&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{ <span class="id" type="keyword">fun</span> <span class="id" type="var">st</span> ⇒ <span class="id" type="var">st</span> <span class="id" type="var">Z</span> = <span class="id" type="var">st</span> <span class="id" type="var">X</span> + <span class="id" type="var">c</span> ∧ <span class="id" type="var">st</span> <span class="id" type="var">Y</span> = 0 <span style='letter-spacing:-.4em;'>}</span>}<br/>
&nbsp;&nbsp;<span class="id" type="var">END</span><br/>
&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{ <span class="id" type="keyword">fun</span> <span class="id" type="var">st</span> ⇒ (<span class="id" type="var">st</span> <span class="id" type="var">Z</span> = <span class="id" type="var">st</span> <span class="id" type="var">X</span> + <span class="id" type="var">c</span> ∧ <span class="id" type="var">st</span> <span class="id" type="var">Y</span> = 0) ∧ <span class="id" type="var">st</span> <span class="id" type="var">X</span> = <span class="id" type="var">a</span> <span style='letter-spacing:-.4em;'>}</span>} <span class="nowrap"><span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>-</span></span><span style='letter-spacing:-.2em;'>></span>></span></span><br/>
&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{ <span class="id" type="keyword">fun</span> <span class="id" type="var">st</span> ⇒ <span class="id" type="var">st</span> <span class="id" type="var">Z</span> = <span class="id" type="var">a</span> + <span class="id" type="var">st</span> <span class="id" type="var">Y</span> + <span class="id" type="var">c</span> <span style='letter-spacing:-.4em;'>}</span>};;<br/>
&nbsp;&nbsp;<span class="id" type="var">WHILE</span> ~(<span class="id" type="var">Y</span> = <span class="id" type="var">b</span>) <span class="id" type="var">DO</span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{ <span class="id" type="keyword">fun</span> <span class="id" type="var">st</span> ⇒ <span class="id" type="var">st</span> <span class="id" type="var">Z</span> = <span class="id" type="var">a</span> + <span class="id" type="var">st</span> <span class="id" type="var">Y</span> + <span class="id" type="var">c</span> ∧ <span class="id" type="var">st</span> <span class="id" type="var">Y</span> ≠ <span class="id" type="var">b</span> <span style='letter-spacing:-.4em;'>}</span>} <span class="nowrap"><span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>-</span></span><span style='letter-spacing:-.2em;'>></span>></span></span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{ <span class="id" type="keyword">fun</span> <span class="id" type="var">st</span> ⇒ <span class="id" type="var">st</span> <span class="id" type="var">Z</span> + 1 = <span class="id" type="var">a</span> + <span class="id" type="var">st</span> <span class="id" type="var">Y</span> + 1 + <span class="id" type="var">c</span> <span style='letter-spacing:-.4em;'>}</span>}<br/>
&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="var">Y</span> <span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>:</span>:</span>=</span> <span class="id" type="var">Y</span> + 1<br/>
&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{ <span class="id" type="keyword">fun</span> <span class="id" type="var">st</span> ⇒ <span class="id" type="var">st</span> <span class="id" type="var">Z</span> + 1 = <span class="id" type="var">a</span> + <span class="id" type="var">st</span> <span class="id" type="var">Y</span> + <span class="id" type="var">c</span> <span style='letter-spacing:-.4em;'>}</span>};;<br/>
&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="var">Z</span> <span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>:</span>:</span>=</span> <span class="id" type="var">Z</span> + 1<br/>
&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{ <span class="id" type="keyword">fun</span> <span class="id" type="var">st</span> ⇒ <span class="id" type="var">st</span> <span class="id" type="var">Z</span> = <span class="id" type="var">a</span> + <span class="id" type="var">st</span> <span class="id" type="var">Y</span> + <span class="id" type="var">c</span> <span style='letter-spacing:-.4em;'>}</span>}<br/>
&nbsp;&nbsp;<span class="id" type="var">END</span><br/>
&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{ <span class="id" type="keyword">fun</span> <span class="id" type="var">st</span> ⇒ (<span class="id" type="var">st</span> <span class="id" type="var">Z</span> = <span class="id" type="var">a</span> + <span class="id" type="var">st</span> <span class="id" type="var">Y</span> + <span class="id" type="var">c</span>) ∧ <span class="id" type="var">st</span> <span class="id" type="var">Y</span> = <span class="id" type="var">b</span> <span style='letter-spacing:-.4em;'>}</span>} <span class="nowrap"><span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>-</span></span><span style='letter-spacing:-.2em;'>></span>></span></span><br/>
&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{ <span class="id" type="keyword">fun</span> <span class="id" type="var">st</span> ⇒ <span class="id" type="var">st</span> <span class="id" type="var">Z</span> = <span class="id" type="var">a</span> + <span class="id" type="var">b</span> + <span class="id" type="var">c</span> <span style='letter-spacing:-.4em;'>}</span>}.<br/><hr class='doublespaceincode'/>
<span class="id" type="keyword">Theorem</span> <span class="id" type="var">two_loops_correct</span> : <span style='font-size:120%;'>&forall;</span><span class="id" type="var">a</span> <span class="id" type="var">b</span> <span class="id" type="var">c</span>,<br/>
&nbsp;&nbsp;<span class="id" type="var">dec_correct</span> (<span class="id" type="var">two_loops_dec</span> <span class="id" type="var">a</span> <span class="id" type="var">b</span> <span class="id" type="var">c</span>).<br/>
<span class="id" type="keyword">Proof</span>. <span class="id" type="tactic">intros</span> <span class="id" type="var">a</span> <span class="id" type="var">b</span> <span class="id" type="var">c</span>. <span class="id" type="var">verify</span>. <span class="id" type="keyword">Qed</span>.<br/>
</div>

<div class="doc">
<a name="lab120"></a><h3 class="section">Power Series</h3>

</div>
<div class="code code-space">

<br/>
<span class="id" type="keyword">Fixpoint</span> <span class="id" type="var">pow2</span> <span class="id" type="var">n</span> :=<br/>
&nbsp;&nbsp;<span class="id" type="keyword">match</span> <span class="id" type="var">n</span> <span class="id" type="keyword">with</span><br/>
&nbsp;&nbsp;| 0 ⇒ 1<br/>
&nbsp;&nbsp;| <span class="id" type="var">S</span> <span class="id" type="var">n'</span> ⇒ 2 * (<span class="id" type="var">pow2</span> <span class="id" type="var">n'</span>)<br/>
&nbsp;&nbsp;<span class="id" type="keyword">end</span>.<br/><hr class='doublespaceincode'/>
<span class="id" type="keyword">Definition</span> <span class="id" type="var">dpow2_down</span> (<span class="id" type="var">n</span> : <span class="id" type="var">nat</span>) :=<br/>
&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{ <span class="id" type="keyword">fun</span> <span class="id" type="var">st</span> ⇒ <span class="id" type="var">True</span> <span style='letter-spacing:-.4em;'>}</span>} <span class="nowrap"><span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>-</span></span><span style='letter-spacing:-.2em;'>></span>></span></span><br/>
&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{ <span class="id" type="keyword">fun</span> <span class="id" type="var">st</span> ⇒ 1 = (<span class="id" type="var">pow2</span> (0 + 1))-1 ∧ 1 = <span class="id" type="var">pow2</span> 0 <span style='letter-spacing:-.4em;'>}</span>}<br/>
&nbsp;&nbsp;<span class="id" type="var">X</span> <span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>:</span>:</span>=</span> 0<br/>
&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{ <span class="id" type="keyword">fun</span> <span class="id" type="var">st</span> ⇒ 1 = (<span class="id" type="var">pow2</span> (0 + 1))-1 ∧ 1 = <span class="id" type="var">pow2</span> (<span class="id" type="var">st</span> <span class="id" type="var">X</span>) <span style='letter-spacing:-.4em;'>}</span>};;<br/>
&nbsp;&nbsp;<span class="id" type="var">Y</span> <span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>:</span>:</span>=</span> 1<br/>
&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{ <span class="id" type="keyword">fun</span> <span class="id" type="var">st</span> ⇒ <span class="id" type="var">st</span> <span class="id" type="var">Y</span> = (<span class="id" type="var">pow2</span> (<span class="id" type="var">st</span> <span class="id" type="var">X</span> + 1))-1 ∧ 1 = <span class="id" type="var">pow2</span> (<span class="id" type="var">st</span> <span class="id" type="var">X</span>) <span style='letter-spacing:-.4em;'>}</span>};;<br/>
&nbsp;&nbsp;<span class="id" type="var">Z</span> <span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>:</span>:</span>=</span> 1<br/>
&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{ <span class="id" type="keyword">fun</span> <span class="id" type="var">st</span> ⇒ <span class="id" type="var">st</span> <span class="id" type="var">Y</span> = (<span class="id" type="var">pow2</span> (<span class="id" type="var">st</span> <span class="id" type="var">X</span> + 1))-1 ∧ <span class="id" type="var">st</span> <span class="id" type="var">Z</span> = <span class="id" type="var">pow2</span> (<span class="id" type="var">st</span> <span class="id" type="var">X</span>) <span style='letter-spacing:-.4em;'>}</span>};;<br/>
&nbsp;&nbsp;<span class="id" type="var">WHILE</span> ~(<span class="id" type="var">X</span> = <span class="id" type="var">n</span>) <span class="id" type="var">DO</span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{ <span class="id" type="keyword">fun</span> <span class="id" type="var">st</span> ⇒ (<span class="id" type="var">st</span> <span class="id" type="var">Y</span> = (<span class="id" type="var">pow2</span> (<span class="id" type="var">st</span> <span class="id" type="var">X</span> + 1))-1 ∧ <span class="id" type="var">st</span> <span class="id" type="var">Z</span> = <span class="id" type="var">pow2</span> (<span class="id" type="var">st</span> <span class="id" type="var">X</span>))<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;∧ <span class="id" type="var">st</span> <span class="id" type="var">X</span> ≠ <span class="id" type="var">n</span> <span style='letter-spacing:-.4em;'>}</span>} <span class="nowrap"><span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>-</span></span><span style='letter-spacing:-.2em;'>></span>></span></span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{ <span class="id" type="keyword">fun</span> <span class="id" type="var">st</span> ⇒ <span class="id" type="var">st</span> <span class="id" type="var">Y</span> + 2 * <span class="id" type="var">st</span> <span class="id" type="var">Z</span> = (<span class="id" type="var">pow2</span> (<span class="id" type="var">st</span> <span class="id" type="var">X</span> + 2))-1<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;∧ 2 * <span class="id" type="var">st</span> <span class="id" type="var">Z</span> = <span class="id" type="var">pow2</span> (<span class="id" type="var">st</span> <span class="id" type="var">X</span> + 1) <span style='letter-spacing:-.4em;'>}</span>}<br/>
&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="var">Z</span> <span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>:</span>:</span>=</span> 2 * <span class="id" type="var">Z</span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{ <span class="id" type="keyword">fun</span> <span class="id" type="var">st</span> ⇒ <span class="id" type="var">st</span> <span class="id" type="var">Y</span> + <span class="id" type="var">st</span> <span class="id" type="var">Z</span> = (<span class="id" type="var">pow2</span> (<span class="id" type="var">st</span> <span class="id" type="var">X</span> + 2))-1<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;∧ <span class="id" type="var">st</span> <span class="id" type="var">Z</span> = <span class="id" type="var">pow2</span> (<span class="id" type="var">st</span> <span class="id" type="var">X</span> + 1) <span style='letter-spacing:-.4em;'>}</span>};;<br/>
&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="var">Y</span> <span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>:</span>:</span>=</span> <span class="id" type="var">Y</span> + <span class="id" type="var">Z</span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{ <span class="id" type="keyword">fun</span> <span class="id" type="var">st</span> ⇒ <span class="id" type="var">st</span> <span class="id" type="var">Y</span> = (<span class="id" type="var">pow2</span> (<span class="id" type="var">st</span> <span class="id" type="var">X</span> + 2))-1<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;∧ <span class="id" type="var">st</span> <span class="id" type="var">Z</span> = <span class="id" type="var">pow2</span> (<span class="id" type="var">st</span> <span class="id" type="var">X</span> + 1) <span style='letter-spacing:-.4em;'>}</span>};;<br/>
&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="var">X</span> <span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>:</span>:</span>=</span> <span class="id" type="var">X</span> + 1<br/>
&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{ <span class="id" type="keyword">fun</span> <span class="id" type="var">st</span> ⇒ <span class="id" type="var">st</span> <span class="id" type="var">Y</span> = (<span class="id" type="var">pow2</span> (<span class="id" type="var">st</span> <span class="id" type="var">X</span> + 1))-1<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;∧ <span class="id" type="var">st</span> <span class="id" type="var">Z</span> = <span class="id" type="var">pow2</span> (<span class="id" type="var">st</span> <span class="id" type="var">X</span>) <span style='letter-spacing:-.4em;'>}</span>}<br/>
&nbsp;&nbsp;<span class="id" type="var">END</span><br/>
&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{ <span class="id" type="keyword">fun</span> <span class="id" type="var">st</span> ⇒ (<span class="id" type="var">st</span> <span class="id" type="var">Y</span> = (<span class="id" type="var">pow2</span> (<span class="id" type="var">st</span> <span class="id" type="var">X</span> + 1))-1 ∧ <span class="id" type="var">st</span> <span class="id" type="var">Z</span> = <span class="id" type="var">pow2</span> (<span class="id" type="var">st</span> <span class="id" type="var">X</span>))<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;∧ <span class="id" type="var">st</span> <span class="id" type="var">X</span> = <span class="id" type="var">n</span> <span style='letter-spacing:-.4em;'>}</span>} <span class="nowrap"><span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>-</span></span><span style='letter-spacing:-.2em;'>></span>></span></span><br/>
&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{ <span class="id" type="keyword">fun</span> <span class="id" type="var">st</span> ⇒ <span class="id" type="var">st</span> <span class="id" type="var">Y</span> = <span class="id" type="var">pow2</span> (<span class="id" type="var">n</span>+1) - 1 <span style='letter-spacing:-.4em;'>}</span>}.<br/><hr class='doublespaceincode'/>
<span class="id" type="keyword">Lemma</span> <span class="id" type="var">pow2_plus_1</span> : <span style='font-size:120%;'>&forall;</span><span class="id" type="var">n</span>,<br/>
&nbsp;&nbsp;<span class="id" type="var">pow2</span> (<span class="id" type="var">n</span>+1) = <span class="id" type="var">pow2</span> <span class="id" type="var">n</span> + <span class="id" type="var">pow2</span> <span class="id" type="var">n</span>.<br/>
<span class="id" type="keyword">Proof</span>. <span class="id" type="tactic">induction</span> <span class="id" type="var">n</span>; <span class="id" type="tactic">simpl</span>. <span class="id" type="tactic">reflexivity</span>. <span class="id" type="tactic">omega</span>. <span class="id" type="keyword">Qed</span>.<br/><hr class='doublespaceincode'/>
<span class="id" type="keyword">Lemma</span> <span class="id" type="var">pow2_le_1</span> : <span style='font-size:120%;'>&forall;</span><span class="id" type="var">n</span>, <span class="id" type="var">pow2</span> <span class="id" type="var">n</span> ≥ 1.<br/>
<span class="id" type="keyword">Proof</span>. <span class="id" type="tactic">induction</span> <span class="id" type="var">n</span>. <span class="id" type="tactic">simpl</span>. <span class="id" type="var">constructor</span>. <span class="id" type="tactic">simpl</span>. <span class="id" type="tactic">omega</span>. <span class="id" type="keyword">Qed</span>.<br/><hr class='doublespaceincode'/>
<span class="id" type="keyword">Theorem</span> <span class="id" type="var">dpow2_down_correct</span> : <span style='font-size:120%;'>&forall;</span><span class="id" type="var">n</span>,<br/>
&nbsp;&nbsp;<span class="id" type="var">dec_correct</span> (<span class="id" type="var">dpow2_down</span> <span class="id" type="var">n</span>).<br/>
<span class="id" type="keyword">Proof</span>.<br/>
&nbsp;&nbsp;<span class="id" type="tactic">intro</span> <span class="id" type="var">m</span>. <span class="id" type="var">verify</span>.<br/>
&nbsp;&nbsp;- <span class="comment">(*&nbsp;1&nbsp;*)</span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="tactic">rewrite</span> <span class="id" type="var">pow2_plus_1</span>. <span class="id" type="tactic">rewrite</span> &lt;- <span class="id" type="var">H<sub>0</sub></span>. <span class="id" type="tactic">reflexivity</span>.<br/>
&nbsp;&nbsp;- <span class="comment">(*&nbsp;2&nbsp;*)</span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="tactic">rewrite</span> &lt;- <span class="id" type="var">plus_n_O</span>.<br/>
&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="tactic">rewrite</span> &lt;- <span class="id" type="var">pow2_plus_1</span>. <span class="id" type="var">remember</span> (<span class="id" type="var">st</span> <span class="id" type="var">X</span>) <span class="id" type="keyword">as</span> <span class="id" type="var">n</span>.<br/>
&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="tactic">replace</span> (<span class="id" type="var">pow2</span> (<span class="id" type="var">n</span> + 1) - 1 + <span class="id" type="var">pow2</span> (<span class="id" type="var">n</span> + 1))<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="keyword">with</span> (<span class="id" type="var">pow2</span> (<span class="id" type="var">n</span> + 1) + <span class="id" type="var">pow2</span> (<span class="id" type="var">n</span> + 1) - 1) <span class="id" type="tactic">by</span> <span class="id" type="tactic">omega</span>.<br/>
&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="tactic">rewrite</span> &lt;- <span class="id" type="var">pow2_plus_1</span>.<br/>
&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="tactic">replace</span> (<span class="id" type="var">n</span> + 1 + 1) <span class="id" type="keyword">with</span> (<span class="id" type="var">n</span> + 2) <span class="id" type="tactic">by</span> <span class="id" type="tactic">omega</span>.<br/>
&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="tactic">reflexivity</span>.<br/>
&nbsp;&nbsp;- <span class="comment">(*&nbsp;3&nbsp;*)</span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="tactic">rewrite</span> &lt;- <span class="id" type="var">plus_n_O</span>. <span class="id" type="tactic">rewrite</span> &lt;- <span class="id" type="var">pow2_plus_1</span>.<br/>
&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="tactic">reflexivity</span>.<br/>
&nbsp;&nbsp;- <span class="comment">(*&nbsp;4&nbsp;*)</span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="tactic">replace</span> (<span class="id" type="var">st</span> <span class="id" type="var">X</span> + 1 + 1) <span class="id" type="keyword">with</span> (<span class="id" type="var">st</span> <span class="id" type="var">X</span> + 2) <span class="id" type="tactic">by</span> <span class="id" type="tactic">omega</span>.<br/>
&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="tactic">reflexivity</span>.<br/>
<span class="id" type="keyword">Qed</span>.<br/>
</div>

<div class="doc">
<a name="lab121"></a><h2 class="section">Further Exercises</h2>

<div class="paragraph"> </div>

<a name="lab122"></a><h4 class="section">Exercise: 3 stars, advanced (slow_assignment_dec)</h4>
 In the <span class="inlinecode"><span class="id" type="var">slow_assignment</span></span> exercise above, we saw a roundabout way
    of assigning a number currently stored in <span class="inlinecode"><span class="id" type="var">X</span></span> to the variable <span class="inlinecode"><span class="id" type="var">Y</span></span>:
    start <span class="inlinecode"><span class="id" type="var">Y</span></span> at <span class="inlinecode">0</span>, then decrement <span class="inlinecode"><span class="id" type="var">X</span></span> until it hits <span class="inlinecode">0</span>,
    incrementing <span class="inlinecode"><span class="id" type="var">Y</span></span> at each step.  Write a formal version of this
    decorated program and prove it correct. 
</div>
<div class="code code-tight">

<span class="id" type="keyword">Example</span> <span class="id" type="var">slow_assignment_dec</span> (<span class="id" type="var">m</span> : <span class="id" type="var">nat</span>) : <span class="id" type="var">decorated</span><br/>
&nbsp;&nbsp;<span class="comment">(*&nbsp;REPLACE&nbsp;THIS&nbsp;LINE&nbsp;WITH&nbsp;":=&nbsp;_your_definition_&nbsp;."&nbsp;*)</span>. <span class="id" type="var">Admitted</span>.<br/><hr class='doublespaceincode'/>
<span class="id" type="keyword">Theorem</span> <span class="id" type="var">slow_assignment_dec_correct</span> : <span style='font-size:120%;'>&forall;</span><span class="id" type="var">m</span>,<br/>
&nbsp;&nbsp;<span class="id" type="var">dec_correct</span> (<span class="id" type="var">slow_assignment_dec</span> <span class="id" type="var">m</span>).<br/>
<span class="id" type="keyword">Proof</span>. <span class="comment">(*&nbsp;FILL&nbsp;IN&nbsp;HERE&nbsp;*)</span> <span class="id" type="var">Admitted</span>.<br/><hr class='doublespaceincode'/>
<span class="comment">(*&nbsp;Do&nbsp;not&nbsp;modify&nbsp;the&nbsp;following&nbsp;line:&nbsp;*)</span><br/>
<span class="id" type="keyword">Definition</span> <span class="id" type="var">manual_grade_for_check_defn_of_slow_assignment_dec</span> : <span class="id" type="var">option</span> (<span class="id" type="var">nat</span>*<span class="id" type="var">string</span>) := <span class="id" type="var">None</span>.<br/>
</div>

<span class="proofbox">&#9744;</span> 
<div class="doc less-space">
<div class="paragraph"> </div>

<a name="lab123"></a><h4 class="section">Exercise: 4 stars, advanced (factorial_dec)</h4>
 Remember the factorial function we worked with before: 
</div>
<div class="code code-tight">

<span class="id" type="keyword">Fixpoint</span> <span class="id" type="var">real_fact</span> (<span class="id" type="var">n</span> : <span class="id" type="var">nat</span>) : <span class="id" type="var">nat</span> :=<br/>
&nbsp;&nbsp;<span class="id" type="keyword">match</span> <span class="id" type="var">n</span> <span class="id" type="keyword">with</span><br/>
&nbsp;&nbsp;| <span class="id" type="var">O</span> ⇒ 1<br/>
&nbsp;&nbsp;| <span class="id" type="var">S</span> <span class="id" type="var">n'</span> ⇒ <span class="id" type="var">n</span> * (<span class="id" type="var">real_fact</span> <span class="id" type="var">n'</span>)<br/>
&nbsp;&nbsp;<span class="id" type="keyword">end</span>.<br/>
</div>

<div class="doc">
Following the pattern of <span class="inlinecode"><span class="id" type="var">subtract_slowly_dec</span></span>, write a decorated
    program <span class="inlinecode"><span class="id" type="var">factorial_dec</span></span> that implements the factorial function and
    prove it correct as <span class="inlinecode"><span class="id" type="var">factorial_dec_correct</span></span>. 
</div>
<div class="code code-tight">

<span class="comment">(*&nbsp;FILL&nbsp;IN&nbsp;HERE&nbsp;*)</span><br/><hr class='doublespaceincode'/>
<span class="comment">(*&nbsp;Do&nbsp;not&nbsp;modify&nbsp;the&nbsp;following&nbsp;line:&nbsp;*)</span><br/>
<span class="id" type="keyword">Definition</span> <span class="id" type="var">manual_grade_for_factorial_dec</span> : <span class="id" type="var">option</span> (<span class="id" type="var">nat</span>*<span class="id" type="var">string</span>) := <span class="id" type="var">None</span>.<br/>
</div>

<span class="proofbox">&#9744;</span> 
<div class="doc less-space">
<div class="paragraph"> </div>

<a name="lab124"></a><h4 class="section">Exercise: 4 stars, advanced, optional (fib_eqn)</h4>
 The Fibonacci function is usually written like this:

<div class="paragraph"> </div>

<div class="code code-tight">
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="keyword">Fixpoint</span>&nbsp;<span class="id" type="var">fib</span>&nbsp;<span class="id" type="var">n</span>&nbsp;:=<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="keyword">match</span>&nbsp;<span class="id" type="var">n</span>&nbsp;<span class="id" type="keyword">with</span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;|&nbsp;0&nbsp;⇒&nbsp;1<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;|&nbsp;1&nbsp;⇒&nbsp;1<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;|&nbsp;<span class="id" type="var">_</span>&nbsp;⇒&nbsp;<span class="id" type="var">fib</span>&nbsp;(<span class="id" type="var">pred</span>&nbsp;<span class="id" type="var">n</span>)&nbsp;+&nbsp;<span class="id" type="var">fib</span>&nbsp;(<span class="id" type="var">pred</span>&nbsp;(<span class="id" type="var">pred</span>&nbsp;<span class="id" type="var">n</span>))<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="keyword">end</span>.
<div class="paragraph"> </div>

</div>
   This doesn't pass Coq's termination checker, but here is a
   slightly clunkier definition that does: 
</div>
<div class="code code-tight">

<span class="id" type="keyword">Fixpoint</span> <span class="id" type="var">fib</span> <span class="id" type="var">n</span> :=<br/>
&nbsp;&nbsp;<span class="id" type="keyword">match</span> <span class="id" type="var">n</span> <span class="id" type="keyword">with</span><br/>
&nbsp;&nbsp;| 0 ⇒ 1<br/>
&nbsp;&nbsp;| <span class="id" type="var">S</span> <span class="id" type="var">n'</span> ⇒ <span class="id" type="keyword">match</span> <span class="id" type="var">n'</span> <span class="id" type="keyword">with</span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;| 0 ⇒ 1<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;| <span class="id" type="var">S</span> <span class="id" type="var">n''</span> ⇒ <span class="id" type="var">fib</span> <span class="id" type="var">n'</span> + <span class="id" type="var">fib</span> <span class="id" type="var">n''</span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="keyword">end</span><br/>
&nbsp;&nbsp;<span class="id" type="keyword">end</span>.<br/>
</div>

<div class="doc">
Prove that <span class="inlinecode"><span class="id" type="var">fib</span></span> satisfies the following equation: 
</div>
<div class="code code-tight">

<span class="id" type="keyword">Lemma</span> <span class="id" type="var">fib_eqn</span> : <span style='font-size:120%;'>&forall;</span><span class="id" type="var">n</span>,<br/>
&nbsp;&nbsp;<span class="id" type="var">n</span> &gt; 0 →<br/>
&nbsp;&nbsp;<span class="id" type="var">fib</span> <span class="id" type="var">n</span> + <span class="id" type="var">fib</span> (<span class="id" type="var">Init.Nat.pred</span> <span class="id" type="var">n</span>) = <span class="id" type="var">fib</span> (<span class="id" type="var">n</span> + 1).<br/>
<span class="id" type="keyword">Proof</span>.<br/>
&nbsp;&nbsp;<span class="comment">(*&nbsp;FILL&nbsp;IN&nbsp;HERE&nbsp;*)</span> <span class="id" type="var">Admitted</span>.<br/>
</div>

<span class="proofbox">&#9744;</span> 
<div class="doc less-space">
<div class="paragraph"> </div>

<a name="lab125"></a><h4 class="section">Exercise: 4 stars, advanced, optional (fib)</h4>
 The following Imp program leaves the value of <span class="inlinecode"><span class="id" type="var">fib</span></span> <span class="inlinecode"><span class="id" type="var">n</span></span> in the
    variable <span class="inlinecode"><span class="id" type="var">Y</span></span> when it terminates:

<div class="paragraph"> </div>

<div class="code code-tight">
&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="var">X</span>&nbsp;<span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>:</span>:</span>=</span>&nbsp;1;;<br/>
&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="var">Y</span>&nbsp;<span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>:</span>:</span>=</span>&nbsp;1;;<br/>
&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="var">Z</span>&nbsp;<span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>:</span>:</span>=</span>&nbsp;1;;<br/>
&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="var">WHILE</span>&nbsp;~(<span class="id" type="var">X</span>&nbsp;=&nbsp;<span class="id" type="var">n</span>&nbsp;+&nbsp;1)&nbsp;<span class="id" type="var">DO</span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="var">T</span>&nbsp;<span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>:</span>:</span>=</span>&nbsp;<span class="id" type="var">Z</span>;;<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="var">Z</span>&nbsp;<span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>:</span>:</span>=</span>&nbsp;<span class="id" type="var">Z</span>&nbsp;+&nbsp;<span class="id" type="var">Y</span>;;<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="var">Y</span>&nbsp;<span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>:</span>:</span>=</span>&nbsp;<span class="id" type="var">T</span>;;<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="var">X</span>&nbsp;<span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>:</span>:</span>=</span>&nbsp;<span class="id" type="var">X</span>&nbsp;+&nbsp;1<br/>
&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="var">END</span>
<div class="paragraph"> </div>

</div>
    Fill in the following definition of <span class="inlinecode"><span class="id" type="var">dfib</span></span> and prove that it
    satisfies this specification:

<div class="paragraph"> </div>

<div class="code code-tight">
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{&nbsp;<span class="id" type="var">True</span>&nbsp;<span style='letter-spacing:-.4em;'>}</span>}&nbsp;<span class="id" type="var">dfib</span>&nbsp;<span style='letter-spacing:-.4em;'>{</span>{&nbsp;<span class="id" type="var">Y</span>&nbsp;=&nbsp;<span class="id" type="var">fib</span>&nbsp;<span class="id" type="var">n</span>&nbsp;<span style='letter-spacing:-.4em;'>}</span>}
<div class="paragraph"> </div>

</div>

</div>
<div class="code code-tight">

<span class="id" type="keyword">Definition</span> <span class="id" type="var">T</span> : <span class="id" type="var">string</span> := "T".<br/><hr class='doublespaceincode'/>
<span class="id" type="keyword">Definition</span> <span class="id" type="var">dfib</span> (<span class="id" type="var">n</span> : <span class="id" type="var">nat</span>) : <span class="id" type="var">decorated</span><br/>
<span class="comment">(*&nbsp;REPLACE&nbsp;THIS&nbsp;LINE&nbsp;WITH&nbsp;":=&nbsp;_your_definition_&nbsp;."&nbsp;*)</span>. <span class="id" type="var">Admitted</span>.<br/><hr class='doublespaceincode'/>
<span class="id" type="keyword">Theorem</span> <span class="id" type="var">dfib_correct</span> : <span style='font-size:120%;'>&forall;</span><span class="id" type="var">n</span>,<br/>
&nbsp;&nbsp;<span class="id" type="var">dec_correct</span> (<span class="id" type="var">dfib</span> <span class="id" type="var">n</span>).<br/>
<span class="comment">(*&nbsp;FILL&nbsp;IN&nbsp;HERE&nbsp;*)</span> <span class="id" type="var">Admitted</span>.<br/>
</div>

<span class="proofbox">&#9744;</span> 
<div class="doc less-space">
<div class="paragraph"> </div>

<a name="lab126"></a><h4 class="section">Exercise: 5 stars, advanced, optional (improve_dcom)</h4>
 The formal decorated programs defined in this section are intended
    to look as similar as possible to the informal ones defined earlier
    in the chapter.  If we drop this requirement, we can eliminate
    almost all annotations, just requiring final postconditions and
    loop invariants to be provided explicitly.  Do this &mdash; i.e., define a
    new version of dcom with as few annotations as possible and adapt the
    rest of the formal development leading up to the <span class="inlinecode"><span class="id" type="var">verification_correct</span></span>
    theorem. 
</div>
<div class="code code-tight">

<span class="comment">(*&nbsp;FILL&nbsp;IN&nbsp;HERE&nbsp;*)</span><br/>
</div>

<span class="proofbox">&#9744;</span> 
<div class="doc less-space">
<div class="paragraph"> </div>

<a name="lab127"></a><h4 class="section">Exercise: 4 stars, advanced, optional (implement_dcom)</h4>
 Adapt the parser for Imp presented in chapter <a href="https://www.cis.upenn.edu/~bcpierce/sf/lf-current/ImpParser.html"><span class="inlineref">ImpParser</span></a>
    of <i>Logical Foundations</i> to parse decorated commands (either ours
    or, even better, the ones you defined in the previous exercise). 
</div>
<div class="code code-tight">

<span class="comment">(*&nbsp;FILL&nbsp;IN&nbsp;HERE&nbsp;*)</span><br/>
</div>

<span class="proofbox">&#9744;</span> 
<div class="code code-tight">

<span class="comment">(*&nbsp;Thu&nbsp;Feb&nbsp;7&nbsp;20:09:23&nbsp;EST&nbsp;2019&nbsp;*)</span><br/>
</div>
</div>



</div>

</body>
</html>